Permalink
Browse files

merge revision(s) 30903:

	* test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
	  Test for below.
	* error.c (exc_to_s): untainted strings can be tainted via
	  Exception#to_s, which enables attackers to overwrite sane strings.
	  Reported by: Yusuke Endoh <mame at tsg.ne.jp>.
	* error.c (name_err_to_s): ditto.


git-svn-id: http://svn.ruby-lang.org/repos/ruby/branches/ruby_1_8_7@30911 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
  • Loading branch information...
1 parent aa436a2 commit 4c5a678c901b6cdbf305da37af92a3fe3c5da385 @shyouhei shyouhei committed Feb 18, 2011
Showing with 38 additions and 5 deletions.
  1. +13 −0 ChangeLog
  2. +2 −4 error.c
  3. +22 −0 test/ruby/test_exception.rb
  4. +1 −1 version.h
View
13 ChangeLog
@@ -1,3 +1,16 @@
+Fri Feb 18 21:18:55 2011 Shugo Maeda <shugo@ruby-lang.org>
+
+ * test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
+ Test for below.
+
+Fri Feb 18 21:18:55 2011 URABE Shyouhei <shyouhei@ruby-lang.org>
+
+ * error.c (exc_to_s): untainted strings can be tainted via
+ Exception#to_s, which enables attackers to overwrite sane strings.
+ Reported by: Yusuke Endoh <mame at tsg.ne.jp>.
+
+ * error.c (name_err_to_s): ditto.
+
Fri Feb 18 21:17:22 2011 Shugo Maeda <shugo@ruby-lang.org>
* lib/fileutils.rb (FileUtils::remove_entry_secure): there is a
View
6 error.c
@@ -403,7 +403,6 @@ exc_to_s(exc)
VALUE mesg = rb_attr_get(exc, rb_intern("mesg"));
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
- if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg);
return mesg;
}
@@ -667,10 +666,9 @@ name_err_to_s(exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
StringValue(str);
if (str != mesg) {
- rb_iv_set(exc, "mesg", mesg = str);
+ OBJ_INFECT(str, mesg);
}
- if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg);
- return mesg;
+ return str;
}
/*
View
22 test/ruby/test_exception.rb
@@ -184,4 +184,26 @@ def test_else
assert(false)
end
end
+
+ def test_to_s_taintness_propagation
+ for exc in [Exception, NameError]
+ m = "abcdefg"
+ e = exc.new(m)
+ e.taint
+ s = e.to_s
+ assert_equal(false, m.tainted?,
+ "#{exc}#to_s should not propagate taintness")
+ assert_equal(false, s.tainted?,
+ "#{exc}#to_s should not propagate taintness")
+ end
+
+ o = Object.new
+ def o.to_str
+ "foo"
+ end
+ o.taint
+ e = NameError.new(o)
+ s = e.to_s
+ assert_equal(true, s.tainted?)
+ end
end
View
2 version.h
@@ -2,7 +2,7 @@
#define RUBY_RELEASE_DATE "2011-02-18"
#define RUBY_VERSION_CODE 187
#define RUBY_RELEASE_CODE 20110218
-#define RUBY_PATCHLEVEL 333
+#define RUBY_PATCHLEVEL 334
#define RUBY_VERSION_MAJOR 1
#define RUBY_VERSION_MINOR 8

0 comments on commit 4c5a678

Please sign in to comment.