From: "Mauricio Fernández" <batsman.geo@...>
Date: 2003-02-14T05:39:00+09:00
Subject: Re: mod_ruby insecury op

On Fri, Feb 14, 2003 at 05:25:13AM +0900, Daniel Carrera wrote:
> On Fri, Feb 14, 2003 at 04:45:43AM +0900, Chris Pine wrote:
> 
> > ----- Original Message -----
> > From: "Daniel Carrera" <dcarrera@math.umd.edu>
> > 
> > Ruby's taintedness behaves differently between internal and external data.
> > ----------------------------
> > 
> > I don't mean to be pedantic, but this isn't really how I would say it.
> > 
> > The only thing Ruby does differently with external data is that it taints
> > it.  Beyond that, Ruby makes no distinction.  In other words, you could get
> > an external string, and it would be tainted, or you could just call
> > str.taint on an internal string; it does the same thing and Ruby deals with
> > it like it would any other tainted string.
> > 
> > That's probably what you were saying, but I thought it might help the
> > original poster if I clarified.
> 
> No, I really do mean that they are different.  Look at the examples I 
> gave.  They are from PickAxe.

I'm reading the Pickaxe p. 259 and for the life of me I cannot
understand why you're saying they are different.

The examples show that tainted-ness is sticky, and that external data is
tainted. I don't see the difference you're talking about; I thus believe
Chris is right.

I've been especially *slow* today (caffeine didn't help) so it could me
my fault, though ;-)

-- 
 _           _                             
| |__   __ _| |_ ___ _ __ ___   __ _ _ __  
| '_ \ / _` | __/ __| '_ ` _ \ / _` | '_ \ 
| |_) | (_| | |_\__ \ | | | | | (_| | | | |
|_.__/ \__,_|\__|___/_| |_| |_|\__,_|_| |_|
	Running Debian GNU/Linux Sid (unstable)
batsman dot geo at yahoo dot com

Checking host system type...
i586-unknown-linux
configure: error: sorry, this is the gnu os, not linux
	-- Topic on #Linux