From: Ryan Davis <ryand-ruby@...>
Date: 2013-03-22T09:34:52+09:00
Subject: Re: Ruby tainting on primitives


On Mar 21, 2013, at 02:34 , Nicolas V. <lists@ruby-forum.com> wrote:

> We would preserve all the semantics. Let me explain.

Which gets you ... what?

Tainting a number makes no sense to me. You can't use it as an attack vector. You can't get it from a socket. You can't get it from a file. Basically... to get a number, you've already untainted it at some point. The only place I can think of where you can get a number from an external resource is via marshal or some other marshalling format. If it is already compromised, you've got other problems.