[ruby-talk:00988] Re: -T2 and require

Hi,

In message "[ruby-talk:00987] Re: -T2 and require"
    on 99/12/18, ts <[e-mail]> writes:

|Y> If the path contains the relative path, security check should have
|Y> done by its absolute path.  I fixed them at my copy of Ruby 1.5.0.
|Y> After checking it for a while, the fix will be merged into 1.4.4.
|
| Sorry if my previous message was not clear (I've a very bad english), but
| there are 2 problems : 

Your English is far better than mine anyway.  

| 1) security check on the absolute path
| 2) security check on the last component. For example actually I've in
|    hash.c 

I had fixed former point only.  I was misunderstanding my code.


|    for (;;) {
|        int safe;
|
|        if (pend) *pend = '\0';
|        safe = path_check_1(p);
|        if (!pend) break;
|        *pend = sep;
|        if (!safe) {
|            return 0;
|        }
|        p = pend + 1;
|        pend = strchr(p, sep);
|    }
|    return 1;

Moving 

|        if (!safe) {
|            return 0;
|        }

right after

|        safe = path_check_1(p);

will fix the latter problem.  This too will be in 1.5.0 on next Monday.

							matz.