From: Sean Russell <ser@...>
Date: 2002-05-07T06:34:41+09:00
Subject: Re: Taintedness inheritence

Yukihiro Matsumoto wrote:

> I see.  I often call it "taint propagation".

Ok.

> Here's the policy:
> 
>   * String taintedness should be propagated eagerly.
>   * Taintedness of other objects are propagated lazily.
> 
> This is because taintedness of strings are marks for external
> (untrusted) data, whereas taintedness of other objects are to mark
> they are created by untrusted code ($SAFE > 3).

Hm. Ok, this is better, but I'm still not sure how I should handle this in 
REXML.  The data is predominantly Strings...  Should it be:

  1) Data created within an application is always untainted, unless 
otherwise set
  2) String content loaded from a file is tainted, but not the tree 
structure itself
  3) Taintedness of REXML Strings are always propegated, regardless of how 
they're set

This seems to match your policy... does it seem correct?

REXML does a lot of pack()/unpack() to do character encodings, and 
taintedness gets lost in here.

--- SER