From: Mark <msparshatt@...>
Date: 2004-02-21T02:13:40+09:00
Subject: Re: tainted symbols?

John W. Long wrote:

>irb(main):001:0> t = "p 'hello world'".taint
>=> "p 'hello world'"
>irb(main):002:0> s = t.intern
>=> :p 'hello world'
>irb(main):003:0> s.tainted?
>=> false
>
>Is this a security vulnerability?
>
>  
>
At first it appears to be since you can then do

irb(main):006:0> $SAFE=1
=> 1
irb(main):006:0> eval s.to_s
"hello world"
=> nil

However I don't think this will actually cause any security problems 
since you need to ask yourself why your program would take a string from 
an external source, convert it to a symbol and then back into a string 
again.


-- 
Mark Sparshatt