From: Daniel Carrera <dcarrera@...>
Date: 2003-02-14T05:25:13+09:00
Subject: Re: mod_ruby insecury op

On Fri, Feb 14, 2003 at 04:45:43AM +0900, Chris Pine wrote:

> ----- Original Message -----
> From: "Daniel Carrera" <dcarrera@math.umd.edu>
> 
> Ruby's taintedness behaves differently between internal and external data.
> ----------------------------
> 
> I don't mean to be pedantic, but this isn't really how I would say it.
> 
> The only thing Ruby does differently with external data is that it taints
> it.  Beyond that, Ruby makes no distinction.  In other words, you could get
> an external string, and it would be tainted, or you could just call
> str.taint on an internal string; it does the same thing and Ruby deals with
> it like it would any other tainted string.
> 
> That's probably what you were saying, but I thought it might help the
> original poster if I clarified.

No, I really do mean that they are different.  Look at the examples I 
gave.  They are from PickAxe.

-- 
Daniel Carrera
Graduate Teaching Assistant.  Math Dept.
University of Maryland.  (301) 405-5137