Re: untaint'ing doesn't seem to work

On Mon, May 10, 2004 at 11:52:34AM +0300, Juha-Jarmo Heinonen wrote:
> 
> Hi, you have to untaint files too.
> 

Thanks for the reply!  Unfortunately, I couldn't get that to work.  I
tried all kinds of File.open(filename).untaint but the script always
died when it tried to initialize the file object.

I did happen to stumble across something that "fixed" this.  I ran the
script exactly as below on another computer and, presto, it worked.  I
thought the two most relevant differences was that the computer on which
the script worked runs Apache 2.0.40 and Ruby 1.8.0 and the computer on
which the script failed runs Apache 2.0.49 and Ruby 1.8.1.  I recompiled
various versions of Apache numerous times to no avail.  Finally, in a
last ditch effort, I just copied the 1.8.0 version of cgi.rb over to the
1.8.1 directory.  Then the script started working.  After diff'ing for a
while, I found out the script would work with the 1.8.1 version of
cgi.rb if I changed line 1128 from
        class Value < DelegateClass(String)
to
        class Value < String

I'm not sure what "The Right Way" is here.  From the information in the
mod_ruby FAQ, I think this script should work, but, of course, I'm
guessing the error is in my script and not actually in cgi.rb.  Any
ideas?

Thanks,
Jeff

> On 10.5.2004, at 10:30, Jeffrey Dik wrote:
> 
> >Hi,
> >
> >I'm really new to all this mod_ruby/CGI stuff so I'm guessing the
> >problems are solely due to my ignorance, but I can't find anything in
> >the docs or examples to help me out.
> >
> >Here's what I'm using: mod_ruby 1.1.3, Apache 2.0.49, Ruby 1.8.1
> >
> >I'm trying to learning about tainting/untainting so I wrote this short
> >script to "cat" a file.
> >
> >         require 'cgi'
> >
> >         query = CGI.new
> >         filename = query["filename"].dup
> >         filename.untaint
> >         File.open(filename) { |f|
> >           f.each_line { |l|
> >                   print l
> >           }
> >         }
> >
> >This works fine if I throw a "RubySafeLevel 0" in the Apache config
> >file, but a safe level of 1 prints this error in the Apache log:
> >[Mon May 10 00:22:18 2004] [error] mod_ruby: error in 
> >ruby\n/var/www/localhost/htdocs/tmp/cat.rbx:7:in `initialize': 
> >Insecure operation - initialize (SecurityError)\n\tfrom 
> >/var/www/localhost/htdocs/tmp/cat.rbx:7:in `open'\n\tfrom 
> >/var/www/localhost/htdocs/tmp/cat.rbx:7\n\tfrom 
> >/usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `load'\n\tfrom 
> >/usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `handler'\n
> >
> >I thought that untaint was supposed to stop the SecurityError from 
> >being
> >thrown.  When I added the line
> >        puts query["filename"].tainted?
> >it prints "false".
> >
> >Any ideas?
> >Jeff
> >
> 
> 
>