# \[Bug:1.9\] $: includes "." when taint mode

**URL:** <https://www.ruby-forum.com/t/bug-1-9-includes-when-taint-mode/152130>\
**Category:** Development\
**Created:** [October 30, 2008, 11:18am UTC](https://www.ruby-forum.com/t/bug-1-9-includes-when-taint-mode/152130 "2008-10-30T11:18:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nobu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/e9c0ed/32.png) [@nobu](https://www.ruby-forum.com/u/nobu)\
**Post date:** [October 30, 2008, 11:18am UTC](https://www.ruby-forum.com/t/bug-1-9-includes-when-taint-mode/152130/1 "2008-10-30T11:18:28Z")

</div>

e$B$J$+$@$G$9!#e(B

-Te$B$r;XDj$7$F$be(B$:e$B$Ke(B"."e$B$,4^$^$l$F$$$^$9!#e(B

$ RUBYOPT=-T ruby18 -e ‘p $:.include?(".")’  
false  
$ RUBYOPT=-T ruby19 -e ‘p $:.include?(".")’  
true

# Index: ruby.c

— ruby.c (revision 20057)  
+++ ruby.c (working copy)  
@@ -77,4 +77,5 @@ struct cmdline\_options {  
int verbose;  
int yydebug;

- int safe\_level;  
unsigned int setids;  
unsigned int dump;  
@@ -338,7 +339,15 @@ DllMain(HINSTANCE dll, DWORD reason, LPV  
#endif

+void ruby\_init\_loadpath\_safe(int safe\_level);  
+  
void  
ruby\_init\_loadpath(void)  
{

- ruby\_init\_loadpath\_safe(0);  
+}
- 

+void  
+ruby\_init\_loadpath\_safe(int safe\_level)  
+{  
VALUE load\_path;  
#if defined LOAD\_RELATIVE  
@@ -385,5 +394,5 @@ ruby\_init\_loadpath(void)  
load\_path = GET\_VM()-\>load\_path;

- if (rb\_safe\_level() == 0) {

- if (safe\_level == 0) {  
ruby\_incpush(getenv(“RUBYLIB”));  
}  
@@ -413,5 +422,5 @@ ruby\_init\_loadpath(void)  
incpush(RUBY\_RELATIVE(RUBY\_ARCHLIB));

- if (rb\_safe\_level() == 0) {

- if (safe\_level == 0) {  
incpush(".");  
}  
@@ -875,5 +884,5 @@ proc\_options(int argc, char \*\*argv, stru  
s += numlen;  
}

- rb\_set\_safe\_level(v);

- if (v \> opt-\>safe\_level) opt-\>safe\_level = v;  
}  
goto reswitch;  
@@ -1065,5 +1074,4 @@ process\_options(VALUE arg)  
char fbuf[MAXPATHLEN];  
int i = proc\_options(argc, argv, opt, 0);

- int safe;

- rb\_safe\_level() == 0 && (s = getenv(“RUBYOPT”))) {

- opt-\>safe\_level == 0 && (s = getenv(“RUBYOPT”))) {  
VALUE src\_enc\_name = opt-\>src.enc.name;  
VALUE ext\_enc\_name = opt-\>ext.enc.name;  
@@ -1094,5 +1102,5 @@ process\_options(VALUE arg)  
}

- if (rb\_safe\_level() \>= 4) {

- if (opt-\>safe\_level \>= 4) {  
OBJ\_TAINT(rb\_argv);  
OBJ\_TAINT(GET\_VM()-\>load\_path);  
@@ -1134,8 +1142,6 @@ process\_options(VALUE arg)  
opt-\>script\_name = rb\_progname;  
opt-\>script = RSTRING\_PTR(opt-\>script\_name);

- safe = rb\_safe\_level();

- rb\_set\_safe\_level\_force(0);

- ruby\_init\_loadpath();

- ruby\_init\_loadpath\_safe(opt-\>safe\_level);  
ruby\_init\_gems(!(opt-\>disable & DISABLE\_BIT(gems)));  
lenc = rb\_locale\_encoding();  
@@ -1169,5 +1175,4 @@ process\_options(VALUE arg)  
process\_sflag(opt);

- rb\_set\_safe\_level\_force(safe);  
if (opt-\>e\_script) {  
rb\_encoding \*eenc;  
@@ -1203,5 +1208,5 @@ process\_options(VALUE arg)  
opt-\>xflag = 0;

- if (rb\_safe\_level() \>= 4) {

- if (opt-\>safe\_level \>= 4) {  
FL\_UNSET(rb\_argv, FL\_TAINT);  
FL\_UNSET(GET\_VM()-\>load\_path, FL\_TAINT);  
@@ -1229,4 +1234,6 @@ process\_options(VALUE arg)  
}

- rb\_set\_safe\_level(opt-\>safe\_level);

- return iseq;  
}  
@@ -1532,5 +1539,5 @@ init\_ids(struct cmdline\_options \*opt)  
if (egid != gid) opt-\>setids |= 2;  
if (uid && opt-\>setids) {

- rb\_set\_safe\_level(1);

- if (opt-\>safe\_level \< 1) opt-\>safe\_level = 1;  
}  
}  
@@ -1544,5 +1551,5 @@ forbid\_setid(const char \*s, struct cmdli  
if (opt-\>setids & 2)  
rb\_raise(rb\_eSecurityError, “no %s allowed while running  
setgid”, s);

- if (rb\_safe\_level() \> 0)

- if (opt-\>safe\_level \> 0)  
rb\_raise(rb\_eSecurityError, “no %s allowed in tainted mode”,  
s);  
}  
Index: test/ruby/test\_rubyoptions.rb  
===================================================================  
— test/ruby/test\_rubyoptions.rb (revision 20057)  
+++ test/ruby/test\_rubyoptions.rb (working copy)  
@@ -200,4 +200,6 @@ class TestRubyOptions \< Test::Unit::Test  
assert\_in\_out\_err([], “”, [], [])

- assert\_in\_out\_err([’-e’, ‘p $:.include?(".")’], “”, [“true”], [])

- ENV[‘RUBYOPT’] = ‘-e “p 1”’  
assert\_in\_out\_err([], “”, [], /invalid switch in RUBYOPT: -e  
(RuntimeError)/)  
@@ -206,4 +208,6 @@ class TestRubyOptions \< Test::Unit::Test  
assert\_in\_out\_err([], “”, [], /no program input from stdin allowed  
in tainted mode (SecurityError)/)

- assert\_in\_out\_err([’-e’, ‘p $:.include?(".")’], “”, [“false”], [])

- ENV[‘RUBYOPT’] = ‘-T4’  
assert\_in\_out\_err([], “”, [], /no program input from stdin allowed  
in tainted mode (SecurityError)/)

---

<div class="post-metadata">

**Author:** ![nobu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/e9c0ed/32.png) [@nobu](https://www.ruby-forum.com/u/nobu)\
**Post date:** [October 30, 2008, 11:45pm UTC](https://www.ruby-forum.com/t/bug-1-9-includes-when-taint-mode/152130/2 "2008-10-30T23:45:50Z")

</div>

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:36997] [Bug:1.9] $: includes “.” when taint  
mode”  
on Thu, 30 Oct 2008 19:16:59 +0900, Nobuyoshi N.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

|-Te$B$r;XDj$7$F$be(B$:e$B$Ke(B".“e$B$,4^$^$l$F$$$^$9!#e(B  
|  
|$ RUBYOPT=-T ruby18 -e 'p $:.include?(”.“)’  
|false  
|$ RUBYOPT=-T ruby19 -e 'p $:.include?(”.")’  
|true

e$B%Q%C%A$rEv$F$F$/$@$5$$!#e(B

---

<div class="post-metadata">

**Author:** ![nobu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/e9c0ed/32.png) [@nobu](https://www.ruby-forum.com/u/nobu)\
**Post date:** [October 31, 2008, 12:17am UTC](https://www.ruby-forum.com/t/bug-1-9-includes-when-taint-mode/152130/3 "2008-10-31T00:17:59Z")

</div>

e$B%A%1%C%He(B #700 e$B$,99?7$5$l$^$7$?!#e(B (by Nobuyoshi N.)

e$B%9%F!\<%?%9e(B Opene$B$+$ie(BClosede$B$KJQ99e(B  
e$B?JD=e(B % 0e$B$+$ie(B100e$B$KJQ99e(B

## Applied in changeset r20067.

[http://redmine.ruby-lang.org/issues/show/700](http://redmine.ruby-lang.org/issues/show/700)