From: ts <decoux@...>
Date: 2002-05-06T21:41:04+09:00
Subject: Re: Taintedness inheritence

>>>>> "M" == Morris, Chris <chris.morris@snelling.com> writes:

M> Sean's REXML does some processing of the strings to support different
M> encodings (calling unpack and pack, I believe), but nothing else really
M> happens to the string contents, yet they lose their taintedness ... then my
M> module runs an instance_eval on these strings. It seems like a security hole
M> to me.

 Well, this problem is well known if you came from a P language.

 This is with such examples that you see the limitations of taint : person
 of p5p has seen this limitation with 5.004 (if my memory is good :-(() and
 personnaly I've always expected that this problem will arrive in ruby.


Guy Decoux