Project

General

Profile

Actions

Bug #15803

closed

File.realpath should always return a tainted string

Added by jeremyevans0 (Jeremy Evans) almost 5 years ago. Updated over 4 years ago.

Status:
Closed
Assignee:
-
Target version:
-
ruby -v:
ruby 2.7.0dev (2019-04-28 realpath-taint a1b4816759) [x86_64-openbsd]
[ruby-core:92443]

Description

This string can include elements that were not in either string
passed to File.realpath, even if one of the strings is an
absolute path, due to symlinks:

Dir.mkdir('b') unless File.directory?('b')
File.write('b/a', '') unless File.file?('b/a')
File.symlink('b', 'c') unless File.symlink?('c')
path = File.realpath('c/a'.untaint, Dir.pwd.untaint)
path # "/home/testr/ruby/b/a"
path.tainted? # should be true, as 'b' comes from file system

Files

realpath-taint.patch (1.65 KB) realpath-taint.patch jeremyevans0 (Jeremy Evans), 04/27/2019 05:11 PM
Actions #1

Updated by nobu (Nobuyoshi Nakada) almost 5 years ago

  • Backport changed from 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN to 2.4: REQUIRED, 2.5: REQUIRED, 2.6: REQUIRED

Updated by nobu (Nobuyoshi Nakada) almost 5 years ago

  • Status changed from Open to Closed

Committed at a15f7dd1fb1148c3d586238ee6907875f2e40379

Updated by nagachika (Tomoyuki Chikanaga) over 4 years ago

  • Backport changed from 2.4: REQUIRED, 2.5: REQUIRED, 2.6: REQUIRED to 2.4: REQUIRED, 2.5: REQUIRED, 2.6: DONE

ruby_2_6 r67713 merged revision(s) a15f7dd1fb1148c3d586238ee6907875f2e40379.

Updated by usa (Usaku NAKAMURA) over 4 years ago

  • Backport changed from 2.4: REQUIRED, 2.5: REQUIRED, 2.6: DONE to 2.4: REQUIRED, 2.5: DONE, 2.6: DONE

ruby_2_5 r67755 merged revision(s) a15f7dd1fb1148c3d586238ee6907875f2e40379.

Actions

Also available in: Atom PDF

Like0
Like0Like0Like0Like0