Re: require SecurityError

On Wed, 2005-01-26 at 10:03 -0500, Alex Reyes wrote:
> One of the strings that the require command is using is tainted.  I
> don't know if it's the string literals you are passing, or the unshift
> you are doing.
>=20
> Every string can be untainted (my_string.untaint) so that this can be
> bypassed, but best practices point out that this is, of course,
> dangerous unless you take great precaution to ensure whatever you are
> untainting really is safe.
>=20
> Google for "Ruby untaint", or search the pickaxe book for tainted
> strings.
>=20
> It might also be possible, I believe, to adjust the SAFE level that
> mod_ruby is using.
>=20

Thanks.  I guessed that was what it was and a few sprinklings
of .untaint around the code proved I was right.  I then whittled them
down to a single .untaint on the appropriate path string and voila, I
saw a LoadError instead!  Always remember to chmod 755 on dirs when
using mod_ruby! ;)

--=20
"Racing turtles, the grapefruit is winning..."

B53 8184 E61F 3604 FBF3  4CCB EF07 2942 30F2 739E



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBB+4ug7wcpQjDyc54RAhyBAJwJEphKEzwAlsdO3vuzdQG6P5cCjgCfX8Tk
gl6MKRUGat65V+syHpQUvpk=
=1JJs
-----END PGP SIGNATURE-----