From: Hannes Wyss <hwyss@...>
Date: 2002-06-06T04:02:49+09:00
Subject: Ruby 1.6.7, tainted, Net::FTP

Hi List

I am running a CGI-Script that should write a file to a remote FTP-Server.

$SAFE - level is set to 1
Ruby's version is 1.6.7 (2002-03-01) [i686-linux]

Here's (in short) what I am trying to do
<snip>
#!/usr/bin/env ruby

$SAFE = 1
require "net/ftp"

ftp = Net::FTP.new("62.12.133.20", "test", "test")
ftp.puttextfile("test/data/0103.txt", "somefile.txt")
</snip>

Here's what I get
> ruby ./test.rb
/usr/local/lib/ruby/1.6/net/ftp.rb:175:in `open': Insecure operation - open
(SecurityError)
        from /usr/local/lib/ruby/1.6/net/ftp.rb:175:in `makeport'
        from /usr/local/lib/ruby/1.6/net/ftp.rb:209:in `transfercmd'
        from /usr/local/lib/ruby/1.6/net/ftp.rb:328:in `storlines'
        from /usr/local/lib/ruby/1.6/net/ftp.rb:327:in `mon_synchronize'
        from /usr/local/lib/ruby/1.6/net/ftp.rb:327:in `storlines'
        from /usr/local/lib/ruby/1.6/net/ftp.rb:413:in `puttextfile'
        from ./test.rb:7


I've tracked my Problem down to TCPsocket.open(host, port).
Both arguments (host, port) are untainted when open is invoked.
However the return value sock has sock.addr[3].tainted? == true

Any suggestions what I could do?

t.i.a.

Hannes