Skip to content
Permalink
Browse files

taint the result of packing if the format string is tained, there's a…

… bunch more of these specs to untag
  • Loading branch information
Alex Gaynor
Alex Gaynor committed Apr 21, 2013
1 parent 2cfce3a commit 70a9015d06e43bf2538d18406bc43d875afcfe7c
Showing with 9 additions and 10 deletions.
  1. +0 −4 spec/tags/core/array/pack/a_tags.txt
  2. +2 −3 topaz/modules/kernel.py
  3. +7 −3 topaz/objects/arrayobject.py
@@ -1,5 +1,3 @@
fails:Array#pack with format 'A' returns a tainted string when the format is tainted
fails:Array#pack with format 'A' returns a tainted string when an empty format is tainted
fails:Array#pack with format 'A' returns a untrusted string when the format is untrusted
fails:Array#pack with format 'A' returns a untrusted string when the empty format is untrusted
fails:Array#pack with format 'A' returns a untrusted string when a pack argument is untrusted
@@ -9,8 +7,6 @@ fails:Array#pack with format 'A' adds all the bytes to the output when passed th
fails:Array#pack with format 'A' adds a space when the value is nil
fails:Array#pack with format 'A' pads the output with spaces when the value is nil
fails:Array#pack with format 'A' does not pad with spaces when passed the '*' modifier and the value is nil
fails:Array#pack with format 'a' returns a tainted string when the format is tainted
fails:Array#pack with format 'a' returns a tainted string when an empty format is tainted
fails:Array#pack with format 'a' returns a untrusted string when the format is untrusted
fails:Array#pack with format 'a' returns a untrusted string when the empty format is untrusted
fails:Array#pack with format 'a' returns a untrusted string when a pack argument is untrusted
@@ -12,11 +12,10 @@
from topaz.modules.process import Process
from topaz.objects.bindingobject import W_BindingObject
from topaz.objects.exceptionobject import W_ExceptionObject
from topaz.objects.procobject import W_ProcObject
from topaz.objects.stringobject import W_StringObject
from topaz.objects.classobject import W_ClassObject
from topaz.objects.moduleobject import W_ModuleObject
from topaz.objects.procobject import W_ProcObject
from topaz.objects.randomobject import W_RandomObject
from topaz.objects.stringobject import W_StringObject


class Kernel(Module):
@@ -268,10 +268,14 @@ def method_last(self, space, w_count=None):
else:
return self.items_w[len(self.items_w) - 1]

@classdef.method("pack", template="str")
def method_pack(self, space, template):
@classdef.method("pack")
def method_pack(self, space, w_template):
template = Coerce.str(space, w_template)
result = RPacker(template, space.listview(self)).operate(space)
return space.newstr_fromchars(result)
w_result = space.newstr_fromchars(result)
if space.is_true(space.send(w_template, space.newsymbol("tainted?"))):
space.send(w_result, space.newsymbol("taint"))
return w_result

@classdef.method("to_ary")
def method_to_ary(self, space):

0 comments on commit 70a9015

Please sign in to comment.
You can’t perform that action at this time.