From: Carlos <angus@...>
Date: 2004-02-21T03:26:52+09:00
Subject: Re: tainted symbols?

> irb(main):001:0> t = "p 'hello world'".taint
> => "p 'hello world'"
> irb(main):002:0> s = t.intern
> => :p 'hello world'
> irb(main):003:0> s.tainted?
> => false
> 
> Is this a security vulnerability?

I can't answer that, but see the following case:

$SAFE=1

ut = "'Hello world'" # untainted string
us = ut.intern	     # untainted symbol

t = gets.chomp # -> happens to be 'Hello world'
s = t.intern   # tainted

now 'us' points to a tainted symbol... I think that would be
undesirable...