Is BigDecimal really not $SAFE?
Why does BigDecimal call SafeStringValue?
irb(main):001:0> $SAFE = 1; BigDecimal.new('1'.taint)
SecurityError: Insecure operation - new
irb(main):001:0> $SAFE = 1; i = '1'.taint.to_i
I think it makes a lot more sense to validate the input within BigDecimal, rather than validate and untaint the string before passing it to BigDecimal.new().
Updated by mrkn (Kenta Murata) over 7 years ago
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
This issue was solved with changeset r38147.
Dmitry, thank you for reporting this issue.
Your contribution to Ruby is greatly appreciated.
May Ruby be with you.
- ext/bigdecimal/bigdecimal.c (BigDecimal_new): stop checking string taintness. [Bug #5508] [ruby-core:40510]