[ruby-talk:00987] Re: -T2 and require

>>>>> "Y" == Yukihiro Matsumoto <[e-mail]> writes:

Y> In message "[ruby-talk:00984] -T2 and require"
Y>     on 99/12/16, ts <[e-mail]> writes:

Y> | Apparently the last component of rb_load_path is not checked (or the check
Y> |is ignored) in mode -T2.  In the following example, I must use RUBYLIB to
Y> |force a check on "."

Y> If the path contains the relative path, security check should have
Y> done by its absolute path.  I fixed them at my copy of Ruby 1.5.0.
Y> After checking it for a while, the fix will be merged into 1.4.4.

 Sorry if my previous message was not clear (I've a very bad english), but
 there are 2 problems : 

 1) security check on the absolute path
 2) security check on the last component. For example actually I've in
hash.c 

    for (;;) {
        int safe;

        if (pend) *pend = '\0';
        safe = path_check_1(p);
        if (!pend) break;
        *pend = sep;
        if (!safe) {
            return 0;
        }
        p = pend + 1;
        pend = strchr(p, sep);
    }
    return 1;

 when pend == 0 (last component) it always return 1 (if I read it
 correctly) and not the value of path_check_1

 These 2 fixes will be in 1.5.0 ?


Guy Decoux