# Dl taint fixes in Ruby 1.8.7-p72 broke Ruby/Tidy

**URL:** <https://www.ruby-forum.com/t/dl-taint-fixes-in-ruby-1-8-7-p72-broke-ruby-tidy/149106>\
**Category:** Ruby\
**Created:** [September 20, 2008, 4:06pm UTC](https://www.ruby-forum.com/t/dl-taint-fixes-in-ruby-1-8-7-p72-broke-ruby-tidy/149106 "2008-09-20T16:06:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kmeaw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ebca7d/32.png) [@kmeaw](https://www.ruby-forum.com/u/kmeaw)\
**Post date:** [September 20, 2008, 4:06pm UTC](https://www.ruby-forum.com/t/dl-taint-fixes-in-ruby-1-8-7-p72-broke-ruby-tidy/149106/1 "2008-09-20T16:06:18Z")

</div>

Greetings,

Since Ruby 1.8.7-p72, I get the following error when using Ruby/Tidy:

SecurityError: Insecure operation - call

Backtrace:  
(eval):5:in `call' (eval):5:in `tidySetErrorBuffer’  
/usr/lib/ruby/1.8/tidy/tidylib.rb:102:in `set_error_buffer' /usr/lib/ruby/1.8/tidy/tidyobj.rb:31:in `initialize’  
/usr/lib/ruby/1.8/tidy.rb:36:in `new' /usr/lib/ruby/1.8/tidy.rb:36:in `new’  
/usr/lib/ruby/1.8/tidy.rb:56:in `open' /usr/lib/ruby/1.8/samizdat/sanitize.rb:106:in `tidy’

The code that calls tidy is as follows:

def tidy(html)  
xml = Tidy.open(:output\_xhtml =\> true, :literal\_attributes =\> true,  
:tidy\_mark =\> false, :wrap =\> 0, :char\_encoding =\> ‘utf8’  
) {|tidy| tidy.clean(html.to\_s.untaint) }

```
xml.taint

```

end

Is it Ruby/Tidy that is doing something wrong, or is the security fix  
in Ruby 1.8.7-p72 (SVN r17872 [0] would be prime suspect) getting  
over-zealous?

[0] [http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17872](http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17872)

Here are the relevant (or so I think) bits of Ruby/Tidy code:

class Tidyobj

# . . .

def initialize(options=nil)  
@diagnostics = Array.new  
@doc = Tidylib.create  
@errors = Array.new  
@errbuf = Tidybuf.new  
@outbuf = Tidybuf.new  
@options = Tidyopt.new(@doc)  
rc = Tidylib.set\_error\_buffer(@doc, @errbuf.struct)  
verify\_severe(rc)  
unless options.nil?  
options.each { |name, value| Tidylib.opt\_parse\_value(@doc, name,  
value) }  
end  
end

# . . .

end

class Tidybuf  
extend DL::Importable

attr\_reader(:struct)

TidyBuffer = struct [  
“TidyAllocator\* allocator”,  
“byte\* bp”,  
“uint size”,  
“uint allocated”,  
“uint next”  
]

def initialize  
@struct = TidyBuffer.malloc  
end

# . . .

end