# Net/LDAP, eRuby/CGI problem **URL:** \ **Category:** Ruby\ **Created:** [August 18, 2006, 6:02pm UTC](https://www.ruby-forum.com/t/net-ldap-eruby-cgi-problem/65492 "2006-08-18T18:02:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 18, 2006, 6:02pm UTC](https://www.ruby-forum.com/t/net-ldap-eruby-cgi-problem/65492/1 "2006-08-18T18:02:53Z")
I’ve been trying to build a CGI LDAP tool for password changes using Net/LDAP (0.0.4), but I’m bumping against what looks like a taint issue. I’ve never dealt with taint before. In irb, my library works perfectly. It finds the dn, attempts a bind with dn/old\_word, and then modifies dn with new\_word. Here are the method calls required to make it work: load ‘ldapengine.rb’ engine = LDAPEngine.new(“properties\_file”) success, msg = engine.change\_password(“uid”, “old\_word”, “new\_word”) # forward to success.html if success In eRuby, the same series of calls with the same parameters put “Insecure operation - initialize” into ldap.rb’s $! variable at the moment of initialization: 1017 def initialize server 1018 begin 1019 @conn = TCPsocket.new( server[:host], server[:port] ) 1020 rescue 1021 #raise LdapError.new( “no connection to server” ) 1022 raise LdapError.new( “no connection to server: #{$!}” ) Can someone help me understand what I need to untaint, and how, to make this work? I’ve already tried the obvious – calling .untaint on the engine object and on all the string parameters in my rhtml file – to no effect. And if by doing so I create undue risk, I’d be glad to know it. (I do limit the “uid” to alphanumeric characters, since it is used as a search key.) Thanks. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 18, 2006, 6:17pm UTC](https://www.ruby-forum.com/t/net-ldap-eruby-cgi-problem/65492/2 "2006-08-18T18:17:56Z")
> > > > > “j” == justin crawford [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes: j\> In eRuby, the same series of calls with the same parameters put j\> “Insecure operation - initialize” into ldap.rb’s $! variable at the j\> moment of initialization: Well, if I remember well eruby run with $SAFE = 1 j\> 1017 def initialize server j\> 1018 begin j\> 1019 @conn = TCPsocket.new( server[:host], server[:port] ) ^^^^^^^^^^^^^ This is this variable which must be, carefully, untainted moulon% ruby -rsocket -e ‘TCPsocket.new(“moulon”.taint, 21)’ moulon% moulon% ruby -rsocket -e ‘$SAFE = 1; TCPsocket.new(“moulon”.taint, 21)’ -e:1:in `initialize’: Insecure operation - initialize (SecurityError) from -e:1 moulon% Guy Decoux