Re: require SecurityError

One of the strings that the require command is using is tainted.  I don't know if it's the string literals you are passing, or the unshift you are doing.

Every string can be untainted (my_string.untaint) so that this can be bypassed, but best practices point out that this is, of course, dangerous unless you take great precaution to ensure whatever you are untainting really is safe.

Google for "Ruby untaint", or search the pickaxe book for tainted strings.

It might also be possible, I believe, to adjust the SAFE level that mod_ruby is using.

HTH.

YiC;
Alex

On Wed, 26 Jan 2005 10:37:45 +0000
Richard Turner <[email protected]> wrote:

> Hi,
> 
> I'm sure this must have been asked before, but my Googling didn't turn
> up anything: in my mod_ruby script I simple want to require a class file
> I've written.  The method is:
> 
>   def displaySections
>     $:.unshift(File.expand_path("../client/"))
>     require 'soap/rpc/driver'
>     require 'page'
>     .
>     .
>     .
>   end
> 
> Ruby throws a wobbly trying to require 'page' though: the error (from
> Apache's log) is:
> 
> [Wed Jan 26 09:58:57 2005] [error]
> mod_ruby: /home/rjt/sara/trunk/src/public_html/sections.rbx:32:in
> `require': Insecure operation - require (SecurityError)
> 
> What do I have to do to require this file?  Temporarily making the dir
> read-only to everyone makes no difference.
> 
> Cheers,
> 
> Richard.
> -- 
> "Racing turtles, the grapefruit is winning..."
> 
>