Re: untaint'ing doesn't seem to work

Hi, you have to untaint files too.

On 10.5.2004, at 10:30, Jeffrey Dik wrote:

> Hi,
>
> I'm really new to all this mod_ruby/CGI stuff so I'm guessing the
> problems are solely due to my ignorance, but I can't find anything in
> the docs or examples to help me out.
>
> Here's what I'm using: mod_ruby 1.1.3, Apache 2.0.49, Ruby 1.8.1
>
> I'm trying to learning about tainting/untainting so I wrote this short
> script to "cat" a file.
>
>          require 'cgi'
>
>          query = CGI.new
>          filename = query["filename"].dup
>          filename.untaint
>          File.open(filename) { |f|
>            f.each_line { |l|
>                    print l
>            }
>          }
>
> This works fine if I throw a "RubySafeLevel 0" in the Apache config
> file, but a safe level of 1 prints this error in the Apache log:
> [Mon May 10 00:22:18 2004] [error] mod_ruby: error in 
> ruby\n/var/www/localhost/htdocs/tmp/cat.rbx:7:in `initialize': 
> Insecure operation - initialize (SecurityError)\n\tfrom 
> /var/www/localhost/htdocs/tmp/cat.rbx:7:in `open'\n\tfrom 
> /var/www/localhost/htdocs/tmp/cat.rbx:7\n\tfrom 
> /usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `load'\n\tfrom 
> /usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `handler'\n
>
> I thought that untaint was supposed to stop the SecurityError from 
> being
> thrown.  When I added the line
>         puts query["filename"].tainted?
> it prints "false".
>
> Any ideas?
> Jeff
>