From: ahoward <ahoward@...>
Date: 2002-11-20T15:52:05+09:00
Subject: Re: untainted, unfrozen, honest-to-god session data!

On Wed, 20 Nov 2002, Chris wrote:

> Well, I tried something just like that...
>
> Just to make sure, though, I tried your PStore.  Again, the session hash is
> coming back tainted and the keys and values are tainted and frozen, so I
> can't untaint them.  Does this not happen to you?
>
> I am using mod_ruby, which I believe sets the $SAFE level to 1.  Is the
> $SAFE level causing things to get frozen somehow?  Is mod_ruby doing this?
> Or is this just how Marshal works?
>
> Hmmm...

don't know about that...

according to the output of

  http://eli.fsl.noaa.gov/ruby/class/0/cgi/session/pstore.cgi

the data is not frozen, but is tainted.  there is nothing in my code which
does this, and i had a peek into session.rb too - seems like there isn't
anthing there either (but i've been up for 20 hours)

i'm guessing the frozen is a mod_ruby thing?

-a

>
>
> ----- Original Message -----
> From: "ahoward" <ahoward@fsl.noaa.gov>
> Newsgroups: comp.lang.ruby
> To: "Chris" <nemo@hellotree.com>
> Sent: Tuesday, November 19, 2002 7:41 PM
> Subject: Re: untainted, unfrozen, honest-to-god session data!
>
>
> On Wed, 20 Nov 2002, Chris wrote:
>
> i put CGI::Session::Pstore on the RAA
>
>   http://www.ruby-lang.org/en/raa-list.rhtml?id=727
>
> this was suggested by matz, but who knows if my implementation is the best
> one.  i'm using in TONS of cgi programs however!
>
> -a
>
> > Hello,
> >
> > I'm trying to find a replacement for CGI::Session::FileStore which works
> > "just like CGI::Session::MemoryStore" (from my perspective, at least),
> > except that it actually saves the session hash to disk.
> >
> > I don't want my objects all converted to Strings.
> > I don't want my objects to be tainted (if they weren't tainted before).
> > I don't want my objects frozen.
> >
>
>
>

-- 

 ====================================
 | Ara Howard
 | NOAA Forecast Systems Laboratory
 | Information and Technology Services
 | Data Systems Group
 | R/FST 325 Broadway
 | Boulder, CO 80305-3328
 | Email: ahoward@fsl.noaa.gov
 | Phone:  303-497-7238
 | Fax:    303-497-7259
 ====================================