From: Paul Brannan <pbrannan@...>
Date: 2002-12-02T23:39:38+09:00
Subject: Re: Symbols and tainting

On Sun, Dec 01, 2002 at 07:53:24PM +0900, Yukihiro Matsumoto wrote:
> |I notice that calling String#intern on a tainted string returns an untainted 
> |symbol. Is this behaviour correct, does it continue for higher values of 
> |$SAFE, and is it secure? What ramifications might using this have?
> 
> Since Symbols are immediate values, there's no way to taint them.
> I haven't think of this issue before.  Hmm.  Maybe interning from
> tainted strings should be prohibited on higer $SAFE level.

Perhaps in higher $SAFE levels sym.id2name should create only tainted
strings, too.

Paul