From: Dmitry Borodaenko <d.borodaenko@...>
Date: 2003-11-04T04:57:53+09:00
Subject: Opening Net::HTTP from mod_ruby script

Did anyone try that? While implementing Pingback client[1], I've stuck
with a SecurityError exception, even though I've untainted the uri that
I'm feeding to Net::HTTP:

content =~ URI::REGEXP::ABS_URI or raise UserError,
    "text/uri-list should contain at least one absolute URI"
uri, scheme = $&, $1
throw :fail unless scheme =~ /^http/
response = Net::HTTP.get_response(URI.parse(uri.untaint))

Does Net::HTTP pick something tainted from the environment that I'm not
aware of?

[1] http://www.hixie.ch/specs/pingback/pingback

-- 
Dmitry Borodaenko