From: Chris Pine <nemo@...>
Date: 2003-02-13T06:12:48+09:00
Subject: Re: mod_ruby insecury op

----- Original Message -----
From: "Daniel Bretoi" <lists@debonair.net>

Thanks guys, this one stings me every time. What exactly does untaining
on the string do?
----------------------------

The idea with tainting is that the string is considered "dangerous"...
probably you got it from the user (who could be trying to hack into your
machine).

Tainting is 'sticky', so if you have something like this:

  safeString = 'hello, Daniel'
  dangerString = 'rm -rf *'

  dangerString.taint

  mixedString = safeString + dangerString

  mixedString.tainted?  #  -->  true


Ruby keeps close track of which strings are 'pure', and which are 'tainted'
by possible harmful data.

You should be very careful when using the `untaint' method.  For strings, I
usually run them through a regexp like /\A[\w\d]{3,20}\Z/ to make sure I
think they are ok.  That regexp accepts strings of digits and letters from 3
to 20 characters in length.  I always use \A and \Z (matching beginning and
end of whole string, not just of a line) when validating tainted strings.


Chris