From: Dylan Northrup <docx@...>
Date: 2002-06-29T02:49:04+09:00
Subject: eruby SAFE question

I'm trying to implement a replacement for the standard apache file listings
by implementing an index.rbx.  I'm running into a problem, though.  I want
to print out a link to everything that is a .rbx file or a directory.
However, when I call File.directory?(x) I get a Security error.  Here's the
relevant code and error.

Dir.foreach('.') {|x|
        next if x =~ /^\.+$/
        @stay = false
        @dir_test = File.directory?(x)
        @stay = true if @dir_test
        @stay = true if x =~ /\.rbx$/
        next unless @stay
        print "<li> <a href=\"#{x}\">#{x}</a>\n"
}


/home/northrup/web/test/index.rbx:17:in `directory?': Insecure operation - directory? (SecurityError)
        from /home/northrup/web/test/index.rbx:17
        from /home/northrup/web/test/index.rbx:14:in `foreach'
        from /home/northrup/web/test/index.rbx:14
        from /usr/local/lib/ruby/site_ruby/1.6/apache/ruby-run.rb:70:in `load'
        from /usr/local/lib/ruby/site_ruby/1.6/apache/ruby-run.rb:70:in `handler'
        from ruby:0


I've tried doing '@dir_test.untaint' and '@dir_test =
File.directory?(x).untaint' and neither works.  I'm wondering what I'm doing
wrong and how I can get the results I want.  Relevant citations from the
pickaxe would be appreciated.

-- 
Dylan Northrup <*> docx@io.com <*> http://www.io.com/~docx/
"Harder to work, harder to strive, hard to be glad to be alive, but it's 
 really worth it if you give it a try." -- Cowboy Mouth, 'Easy'