From: sabbyxtabby@... (Sabby and Tabby)
Date: 2003-08-27T18:10:18+09:00
Subject: Re: Specification of Ruby regex?

Hal Fulton <hal9000@hypermetrics.com> wrote:

> >>> Ruby's regular expressions are almost identical to Perl's.
> >>
> >> Except where they are different. The biggest glaring difference is that
> >> ^ and $ do not mean "match start of string" and "match end of string"
> >>
> >>   a.untaint if /^[a-z]+$/ =~ a        # WRONG and maybe dangerous
> >>   a.untaint if /\A[a-z]+\z/ =~ a      # right
> >>
> > what do ^ and $ mean then?  they do match start and end for me.  what 
> > else do they match? *shudders at thought of changing lots of code
> 
> Isn't it an issue only in multiline mode? In that case, I think
> ^ and $ would match the start and end of the line rather than
> the entire string.

In Ruby, ^ and $ match the start and end of *lines* not strings.
Multiline mode only tweaks whether . matches newline or not.  So
using Brian's example:

  a = "srand\n`rm -rf /`"
  a.untaint if /^[a-z]+$/ =~ a    # matches "srand"
  eval a                          # BOOM!