From: ts <decoux@...>
Date: 2002-04-29T18:02:53+09:00
Subject: Re: Security bug in load()

>>>>> "T" == Teague Sheridan <teague@apicom.com> writes:

T> E:\code\ft\client> type b.rb
T> fileName = "hellomsg.rb"
T> f = open(fileName, "w")
T> f.print "puts 'Hi'\n"
T> f.close
T> puts fileName.tainted?
T> load(fileName, true)
T> Thread.start {
T>   $SAFE = 4
T>   load(fileName, true)
T> }.join


pigeon% cat b.rb
#!/usr/bin/ruby
fileName = "hellomsg.rb"
f = open(fileName, "w")
f.print "puts 'Hi'"
f.close
puts fileName.tainted?
load(fileName, true)
Thread.start {
   $LOAD_PATH.clear
   $SAFE = 4
   load(fileName, true)
}.join

pigeon% 

pigeon% b.rb
false
Hi
hellomsg.rb:1:in `write': Insecure operation `write' at level 4 (SecurityError)
        from ./b.rb:8:in `join'
        from ./b.rb:8
pigeon% 


Guy Decoux