Re: untaint'ing doesn't seem to work

Hi,

Thanks for the reply.  What you wrote works beautifully.

Would it be proper to change the answer in the mod_ruby FAQ to
   query = CGI.new
   filename = query.params["filename"][0].dup
   filename.untaint
   open(filename)

Thanks again for your answer, and for mod_ruby :-)
Jeff
        
On Sun, May 16, 2004 at 10:48:07PM +0900, Shugo Maeda wrote:
> Hi,
> 
> At Sun, 16 May 2004 00:39:58 -0400,
> Jeffrey Dik <[email protected]> wrote:
> > Thanks for the reply!  Unfortunately, I couldn't get that to work.  I
> > tried all kinds of File.open(filename).untaint but the script always
> > died when it tried to initialize the file object.
> > 
> > I did happen to stumble across something that "fixed" this.  I ran the
> > script exactly as below on another computer and, presto, it worked.  I
> > thought the two most relevant differences was that the computer on which
> > the script worked runs Apache 2.0.40 and Ruby 1.8.0 and the computer on
> > which the script failed runs Apache 2.0.49 and Ruby 1.8.1.  I recompiled
> > various versions of Apache numerous times to no avail.  Finally, in a
> > last ditch effort, I just copied the 1.8.0 version of cgi.rb over to the
> > 1.8.1 directory.  Then the script started working.  After diff'ing for a
> > while, I found out the script would work with the 1.8.1 version of
> > cgi.rb if I changed line 1128 from
> >         class Value < DelegateClass(String)
> > to
> >         class Value < String
> > 
> > I'm not sure what "The Right Way" is here.  From the information in the
> > mod_ruby FAQ, I think this script should work, but, of course, I'm
> > guessing the error is in my script and not actually in cgi.rb.  Any
> > ideas?
> 
> It's a problem of cgi.rb.
> 
> CGI#[] doesn't return String objects, so the return value can't
> be used where String expected.
> If you want String, you should use query.params["filename"][0].
> 
>   require 'cgi'
> 
>   query = CGI.new
>   filename = query.params["filename"][0].dup
>   filename.untaint
>   File.open(filename) { |f|
>     f.each_line { |l|
>       print l
>     }
>   }
> 
> Shugo
> 
>