From: Gavin Kistner <gavin@...>
Date: 2004-02-19T10:59:54+09:00
Subject: Re: eval and mod_ruby/eRuby

David Heinemeier Hansson wrote:
> <IfModule mod_ruby.c>
> # other settings
> RubySafeLevel 0
> </IfModule>
> 
> This removes all the tainted security. So beware...

While I appreciate that this will work, I don't understand why it's 
necessary.

According to:
http://phrogz.net/ProgrammingRuby/frameset.asp?content=taint.asp%23safelevels

$SAFE>=1 : [...] Can't eval tainted strings.

As noted, the string involved isn't tainted. (And even if it had been, 
the call to #untaint would have untainted it, since it's not until 
$SAFE>=3 that things can't be untainted.)

So...why is mod_ruby borking? Does it somehow impose different rules on 
what $SAFE means?
-- 
(-, /\ \/ / /\/