e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B
In message “Re: [ruby-dev:29415] /tmp”
on Sun, 3 Sep 2006 01:27:34 +0900, Tanaka A. [email protected]
writes:
|e$B$3$l$C$F!“$J$s$G87$7$/$J$C$?$s$G$7$?$C$1e(B?
|
|/tmp e$B$Oe(B sticky bit e$B$,$D$$$F$$$k$N$G!”$=$l$[$I4m81$G$O$J$$$He(B
|e$BG’<1$7$F$$$k$N$G$9$,!#e(B
|e$B$?$7$+0JA00l;~e(B sticky bit e$B$r8+$k$h$&$K$J$C$?$3$H$,$“$C$?$h$&e(B
|e$B$J3P$($,$J$/$b$J$$$s$G$9$,!”$J$s$G:#$N$h$&$JF0:n$K$J$C$A$c$Ce(B
|e$B$?$s$G$7$?$C$1e(B?
e$B%U%!%$%k$,CV$-49$($i$l$k?4G[$O$J$$$s$G$9$1$I!"?7$?$K:n$k$3$He(B
e$B$O$G$-$k$N$G!“4{B8$N%3%^%s%I$HF1L>$N<B9T%U%!%$%k$rCV$+$l$A$ce(B
e$B$&$H$=$C$A$,M%@hE*$K<B9T$5$l$A$c$&$+$i!”$@$C$?$h$&$J5$$,$7$^e(B
e$B$9!#e(B
e$B4m81$8$c$J$$$s$@$C$?$i!“4K$a$?$$5$;}$A$O$”$k$N$G$9!#C/$+!V$=e(B
e$B$l$O$^$D$b$H$N;W$$2a$4$7$G4m81$8$c$J$$$s$@!W$H8@$C$F$/$l$J$$e(B
e$B$+$J$"!#e(B
e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B
In message “Re: [ruby-dev:29465] Re: /tmp”
on Mon, 4 Sep 2006 16:54:18 +0900, Tanaka A. [email protected]
writes:
|e$B;d$,?R$M$?$$$N$O!"e(B/tmp/foo/bin e$B$J$I$Ne(B world writable e$B$G$J$$e(B
|e$B%5%V%G%#%l%/%H%j$K$D$$$F$G$9!#e(B
|
|e$B$=$N$h$&$J%5%V%G%#%l%/%H%j$K$D$$$F$b7Y9p$,=P$kM}M3$O$J$s$G$7$ge(B
|e$B$&e(B?
e$B$(!<$H!“?F%G%#%l%/%H%j$,e(Bworld writablee$B$G$be(Bsticky
bite$B$,$D$$$Fe(B
e$B$$$l$P!”%5%V%G%#%l%/%H%j$K$D$$$F7Y9p$r=P$9I,MW$O$J$$!"$H$$$&e(B
e$B$3$H$G$9$+$M!#e(B
e$B$=$s$J5$$b$7$^$9!#e(B
e$BCfED$5$s$N%Q%C%Ae(B([ruby-dev:29433]e$B$H$+e(B)e$B$O$3$l$K1h$C$?$b$N$J$se(B
e$B$G$7$g$&$+!#e(B
e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B
In message “Re: [ruby-dev:29478] Re: /tmp”
on Tue, 5 Sep 2006 04:48:19 +0900, [email protected] writes:
|> e$B$(!<$H!"?F%G%#%l%/%H%j$,e(Bworld writablee$B$G$be(Bsticky bite$B$,$D$$$Fe(B
|> e$B$$$l$P!"%5%V%G%#%l%/%H%j$K$D$$$F7Y9p$r=P$9I,MW$O$J$$!"$H$$$&e(B
|> e$B$3$H$G$9$+$M!#e(B
|
|e$B$=$l$OBgJ,A0$KL58z$K$J$C$F$$$k$H$$$&$+!"$=$l0JA0$N!Ve(Bstickye$B$J%5e(B
|e$B%V%G%#%l%/%H%j$be(BOKe$B!W$H$$$&>uBV$KLa$5$l$F$^$9$M!#e(B
e$B$=$&$J$s$G$9$+!#$J$s$+;v>p$,$"$C$?$s$G$7$g$&$+!#$=$l$H$bNc$Ke(B
e$B$h$C$F;d$N%]%+!)e(B
|> e$BCfED$5$s$N%Q%C%Ae(B([ruby-dev:29433]e$B$H$+e(B)e$B$O$3$l$K1h$C$?$b$N$J$se(B
|> e$B$G$7$g$&$+!#e(B
|
|e$B$J$C$F$J$$$G$9!#e(B
e$BL2$?$/$F%3!<%I$rFI$`5$NO$,$J$$$s$G$9$,!"$3$N%Q%C%A$,?F%G%#%le(B
e$B%/%H%j$,e(Bstickye$B$@$C$?$ie(Bworld
writablee$B$G$b7Y9p$7$J$$!#$G$b!“Kve(B
e$BC<%G%#%l%/%H%j$Oe(Bstickye$B$G$b7Y9p!”$H$$$&5sF0$@$C$?$i%3%_%C%H$7e(B
e$B$F$/$@$5$$$^$;$s$+!#e(B
e$B$=$&$G$J$$$J$i;d$,L@F|%Q%C%A$r=q$-$^$9!#e(B
e$B$J$+$@$G$9!#e(B
At Tue, 5 Sep 2006 01:01:38 +0900,
Yukihiro M. wrote in [ruby-dev:29477]:
|e$B;d$,?R$M$?$$$N$O!"e(B/tmp/foo/bin e$B$J$I$Ne(B world writable e$B$G$J$$e(B
|e$B%5%V%G%#%l%/%H%j$K$D$$$F$G$9!#e(B
|
|e$B$=$N$h$&$J%5%V%G%#%l%/%H%j$K$D$$$F$b7Y9p$,=P$kM}M3$O$J$s$G$7$ge(B
|e$B$&e(B?
e$B$(!<$H!"?F%G%#%l%/%H%j$,e(Bworld writablee$B$G$be(Bsticky bite$B$,$D$$$Fe(B
e$B$$$l$P!"%5%V%G%#%l%/%H%j$K$D$$$F7Y9p$r=P$9I,MW$O$J$$!"$H$$$&e(B
e$B$3$H$G$9$+$M!#e(B
e$B$=$l$OBgJ,A0$KL58z$K$J$C$F$$$k$H$$$&$+!"$=$l0JA0$N!Ve(Bstickye$B$J%5e(B
e$B%V%G%#%l%/%H%j$be(BOKe$B!W$H$$$&>uBV$KLa$5$l$F$^$9$M!#e(B
e$BCfED$5$s$N%Q%C%Ae(B([ruby-dev:29433]e$B$H$+e(B)e$B$O$3$l$K1h$C$?$b$N$J$se(B
e$B$G$7$g$&$+!#e(B
e$B$J$C$F$J$$$G$9!#e(B
Index: file.c
RCS file: /cvs/ruby/src/ruby/file.c,v
retrieving revision 1.247
diff -p -U 2 -r1.247 file.c
— file.c 2 Sep 2006 14:42:05 -0000 1.247
+++ file.c 4 Sep 2006 19:42:32 -0000
@@ -4047,5 +4047,5 @@ is_absolute_path(const char *path)
#ifndef DOSISH
static int
-path_check_0(VALUE path, int loadpath)
+path_check_0(VALUE path, int stickyok)
{
struct stat st;
@@ -4062,5 +4062,5 @@ path_check_0(VALUE path, int loadpath)
rb_str_cat2(newpath, “/”);
rb_str_cat2(newpath, p0);
- return path_check_0(newpath, loadpath);
- p0 = RSTRING_PTR(path = newpath);
}
for (;
{
@@ -4070,5 +4070,5 @@ path_check_0(VALUE path, int loadpath)
if (stat(p0, &st) == 0 && S_ISDIR(st.st_mode) && (st.st_mode &
S_IWOTH)
#ifdef S_ISVTX
#endif
&& !access(p0, W_OK)) {
@@ -4248,7 +4248,4 @@ rb_find_file(VALUE path)
else {
lpath = RSTRING_PTR(tmp);
-
if (rb_safe_level() >= 1 && !rb_path_check(lpath)) {
-
rb_raise(rb_eSecurityError, "loading from unsafe path %s", lpath);
-
}
}
}
e$B$J$+$@$G$9!#e(B
At Tue, 5 Sep 2006 05:00:13 +0900,
Yukihiro M. wrote in [ruby-dev:29480]:
|> e$B$(!<$H!"?F%G%#%l%/%H%j$,e(Bworld writablee$B$G$be(Bsticky bite$B$,$D$$$Fe(B
|> e$B$$$l$P!"%5%V%G%#%l%/%H%j$K$D$$$F7Y9p$r=P$9I,MW$O$J$$!"$H$$$&e(B
|> e$B$3$H$G$9$+$M!#e(B
|
|e$B$=$l$OBgJ,A0$KL58z$K$J$C$F$$$k$H$$$&$+!"$=$l0JA0$N!Ve(Bstickye$B$J%5e(B
|e$B%V%G%#%l%/%H%j$be(BOKe$B!W$H$$$&>uBV$KLa$5$l$F$^$9$M!#e(B
e$B$=$&$J$s$G$9$+!#$J$s$+;v>p$,$"$C$?$s$G$7$g$&$+!#$=$l$H$bNc$Ke(B
e$B$h$C$F;d$N%]%+!)e(B
file.c:1.164e$B$N%m%0$K$h$k$He(B[ruby-talk:86273]e$B$i$7$$$s$G$9$,!"$3$le(B
e$B$Oe(B /tmp
e$B$rD>@\e(BPATHe$B$KF~$l$F$$$k$H$$$&!"e(B[ruby-dev:29464]e$B$G$^$5$Ke(B
e$BLdBj$K$5$l$F$$$k>uBV$@$H;W$$$^$9!#e(B
|> e$BCfED$5$s$N%Q%C%Ae(B([ruby-dev:29433]e$B$H$+e(B)e$B$O$3$l$K1h$C$?$b$N$J$se(B
|> e$B$G$7$g$&$+!#e(B
|
|e$B$J$C$F$J$$$G$9!#e(B
e$BL2$?$/$F%3!<%I$rFI$`5$NO$,$J$$$s$G$9$,!"$3$N%Q%C%A$,?F%G%#%le(B
e$B%/%H%j$,e(Bstickye$B$@$C$?$ie(Bworld writablee$B$G$b7Y9p$7$J$$!#$G$b!“Kve(B
e$BC<%G%#%l%/%H%j$Oe(Bstickye$B$G$b7Y9p!”$H$$$&5sF0$@$C$?$i%3%_%C%H$7e(B
e$B$F$/$@$5$$$^$;$s$+!#e(B
[ruby-talk:211922]e$B$b$$$C$7$g$KF~$l$^$7$?!#e(B