From: ts <decoux@...>
Date: 2003-02-13T17:29:27+09:00
Subject: Re: mod_ruby insecury op

>>>>> "D" == Daniel Carrera <dcarrera@math.umd.edu> writes:

D> Do something like:

 Probably you make confusion with another language

D> # dir tainted.
D> if dir =~ /^([\w\/]+)$/
D>     dir = $1  # Untainted.
D> else
D>     # Error...
D> end

pigeon% cat b.rb
#!/usr/bin/ruby
dir = "aaa".taint
if dir =~ /^([\w\/]+)$/
   dir = $1
else
   raise "error"
end
p dir.tainted?
pigeon%
 
pigeon% b.rb
true
pigeon% 


Guy Decoux