From 1a759bfe5d554c22571d2e6e4e5998cf06a7b98f Mon Sep 17 00:00:00 2001 From: Jeremy Evans Date: Thu, 20 Jun 2019 11:50:22 -0700 Subject: Do not always taint the result of File#path The result should only be tainted if the path given to the method was tainted. The code to always taint the result was added in a4934a42cbb84b6679912226581c71b435671f55 (svn revision 4892) in 2003 by matz. However, the change wasn't mentioned in the commit message, and it may have been committed by accident. Skip part of a readline test that uses Reline. Reline in general would pass the test, but Reline's test mode doesn't raise a SecurityError if passing a tainted prompt and $SAFE >= 1. This was hidden earlier because File#path was always returning a tainted string. Fixes [Bug #14485] --- test/ruby/test_file_exhaustive.rb | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'test/ruby/test_file_exhaustive.rb') diff --git a/test/ruby/test_file_exhaustive.rb b/test/ruby/test_file_exhaustive.rb index 98a894698d..a702ed55e7 100644 --- a/test/ruby/test_file_exhaustive.rb +++ b/test/ruby/test_file_exhaustive.rb @@ -187,6 +187,22 @@ class TestFileExhaustive < Test::Unit::TestCase end end + def test_path_taint + [regular_file, utf8_file].each do |file| + assert_equal(false, File.open(file) {|f| f.path}.tainted?) + assert_equal(true, File.open(file.dup.taint) {|f| f.path}.tainted?) + o = Object.new + class << o; self; end.class_eval do + define_method(:to_path) { file } + end + assert_equal(false, File.open(o) {|f| f.path}.tainted?) + class << o; self; end.class_eval do + define_method(:to_path) { file.dup.taint } + end + assert_equal(true, File.open(o) {|f| f.path}.tainted?) + end + end + def assert_integer(n) assert_kind_of(Integer, n) end -- cgit v1.2.3