From: David Garamond <lists@...6.isreserved.com>
Date: 2003-10-30T16:20:19+09:00
Subject: Re: [BUG] system() isn't safe on win32

Yukihiro Matsumoto wrote:
> |   ruby -ve "$SAFE = 5; system 'echo Was able to run an arbitrary command
> |   in safe mode.'"
> |
> |produces this scary result:
> |
> |   ruby 1.8.0 (2003-08-04) [i386-mswin32]
> |   Was able to run an arbitrary command in safe mode.
> 
> It shouldn't happen.  Does anyone confirm this?

Yes, same output here. Ruby 1.8.0 (mswin32), CMD.EXE, Win2k+SP2. Also 
same output regardless of $SAFE is 3, 4, 5. $SAFE >= 3 correctly forbids 
system() on my Linux box.

Haven't tried the cygwin version though.

-- 
dave