# Ruby1.9 $B$G$N(B $SAFE==4 $B$G$NF0:n$N;EMMJQ99$K$D$$$F(B

**URL:** <https://www.ruby-forum.com/t/ruby1-9-b-g-n-b-safe-4-b-g-nf0-n-n-emmjq99-k-d-f-b/133639>\
**Category:** Development\
**Created:** [April 2, 2008, 6:38am UTC](https://www.ruby-forum.com/t/ruby1-9-b-g-n-b-safe-4-b-g-nf0-n-n-emmjq99-k-d-f-b/133639 "2008-04-02T06:38:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hidetoshi\_NAGAI](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/49beb7/32.png) [@Hidetoshi\_NAGAI](https://www.ruby-forum.com/u/Hidetoshi_NAGAI)\
**Post date:** [April 2, 2008, 6:38am UTC](https://www.ruby-forum.com/t/ruby1-9-b-g-n-b-safe-4-b-g-nf0-n-n-emmjq99-k-d-f-b/133639/1 "2008-04-02T06:38:24Z")

</div>

e$B1J0f!wCNG=!%6e9)Bg$G$9!%e(B

e$BI8Bj$N7o$K$D$$$F$G$9$+!$$I$3$+$K$^$H$a$i$l$?\>pJs$H$+$O$J$$$G$7$g$&$+!)e(B

e$B$H$j$"$($:8=\>u$G!$e(Brb\_str\_intern e$B$N;EMMJQ99$Ge(B  
SecurityError e$B$r=P$9$h$&$K$J$C$F:$$C$F$^$9!%e(B  
e$BB\>$K$b;EMMJQ99$,$"$k$J$i$=$l$K9g$o$;$?BP:v$,I,MW$K$J$j$=$&$G$9$N$G!$e(B  
e$B\>pJse(B (e$B!VL$@0M}$GITL@!W$H$$$&\>pJs$r4^$`e(B)  
e$B$r8fB8CN$NJ}$,$"$j$^$7$?$ie(B  
e$B65$($F$$$?$@$1$J$$$G$7$g$&$+!%e(B

rb\_str\_intern e$B$N;EMMJQ99$N7o$O!$e(B  
1.8 e$B$K$OB8:\_$7$?e(B !rb\_sym\_interned\_p(str)  
e$B$N%A%’%C%/$,\>C$($?$?$a!$e(B  
e$BEO$5$l$?J8;zNs$r%A%’%C%/$7$Fe(B **send**  
e$B$GAw$k$h$&$K$7$F$$$?$b$N$,e(B  
e$BF0$+$J$/$J$C$?e(B (Insecure: can’t intern tainted string)  
e$B$H$$$&$b$N$G$9!%e(B

e$B$3$N;EMMJQ99$OI,MW$J$b$N$@$C$?$N$G$7$g$&$+!)e(B  
symbol e$B$,e(B GC e$B$5$l$J$$$?$a$KEPO?$5$l$ke(B symbol e$B$NNL$re(B  
e$BGzH/$5$;$J$$$?$a$H$$$&$N$J$iM}2r$G$-$b$9$k$N$G$9$,!$e(B  
rb\_sym\_interned\_p e$B$O$9$G$KB8:\_$9$k$b$N$K$D$$$F$Oe(B OK  
e$B$H$$$&$3$H$Ge(B  
e$BG{$j$rF~$l$F$$$k$o$1$G$9$N$G!$EPO?e(B symbol  
e$BNL$OA}$($^$;$s$h$M!)e(B  
e$B$=$l$K!$e(B

s = ‘foo’.taint; Thread.new{$SAFE=4; eval “:#{s}”}.value

e$B$H$+e(B

Thread.new{$SAFE=4; s = ‘foo’; eval “:#{s}” if s.tainted?}.value

e$B$H$+$OLdBj$J$/\<B9T$G$-$F!$$"$C$5$j$He(B symbol  
e$B$r@8@.$7$F$7$^$&$N$Ge(B  
e$B;EMMJQ99$NM}M3$,$h$/J,$+$i$J$$$G$9!%e(B

e$B$=$l$H$b!$C1$K;d$,%;%-%e%j%F%#$NLdBj$rM}2r$G$-$F$$$J$$$@$1$G!$e(B  
e$B%;%-%e%j%F%#%[!\<%k$K$J$j$&$k$h$&$JJL$N%1!\<%9$,B8:\_$9$k$N$G$7$g$&$+!)e(B

---

<div class="post-metadata">

**Author:** ![Hidetoshi\_NAGAI](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/49beb7/32.png) [@Hidetoshi\_NAGAI](https://www.ruby-forum.com/u/Hidetoshi_NAGAI)\
**Post date:** [April 6, 2008, 7:17pm UTC](https://www.ruby-forum.com/t/ruby1-9-b-g-n-b-safe-4-b-g-nf0-n-n-emmjq99-k-d-f-b/133639/2 "2008-04-06T19:17:30Z")

</div>

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:34219] Ruby1.9 e$B$G$Ne(B $SAFE==4  
e$B$G$NF0:n$N;EMMJQ99$K$D$$$Fe(B”  
on Wed, 2 Apr 2008 13:37:50 +0900, Hidetoshi NAGAI  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

|e$B$H$j$“$($:8=\>u$G!$e(Brb\_str\_intern e$B$N;EMMJQ99$Ge(B  
|SecurityError e$B$r=P$9$h$&$K$J$C$F:$$C$F$^$9!%e(B  
|e$BB\>$K$b;EMMJQ99$,$”$k$J$i$=$l$K9g$o$;$?BP:v$,I,MW$K$J$j$=$&$G$9$N$G!$e(B  
|e$B\>pJse(B (e$B!VL$@0M}$GITL@!W$H$$$&\>pJs$r4^$`e(B) e$B$r8fB8CN$NJ}$,$"$j$^$7$?$ie(B  
|e$B65$($F$$$?$@$1$J$$$G$7$g$&$+!%e(B

e$B%a!\<%k$r$$$?$@$$$?8e$$$m$$$m9M$($?$N$G$9$,!"e(BString#interne$B$Ke(B  
e$B$Oe(Btaintede$B%A%'%C%/$OITMW$H$$$&7kO@$K$J$j$^$7$?!#e(B1.9e$B$G$O\<h$j=|e(B  
e$B$-$^$9!#e(B1.8e$B$G$be(Brb\_sym\_interned\_p(str)e$B$H$b$I$b:o=|$7$F$b$+$^e(B  
e$B$o$J$$$H;W$$$^$9!#e(B

---

<div class="post-metadata">

**Author:** ![Hidetoshi\_NAGAI](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/49beb7/32.png) [@Hidetoshi\_NAGAI](https://www.ruby-forum.com/u/Hidetoshi_NAGAI)\
**Post date:** [April 7, 2008, 3:40am UTC](https://www.ruby-forum.com/t/ruby1-9-b-g-n-b-safe-4-b-g-nf0-n-n-emmjq99-k-d-f-b/133639/3 "2008-04-07T03:40:20Z")

</div>

e$B1J0f!wCNG=!%6e9)Bg$G$9!%e(B

From: Yukihiro M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
Subject: [ruby-dev:34264] Re: Ruby1.9 e$B$G$Ne(B $SAFE==4  
e$B$G$NF0:n$N;EMMJQ99$K$D$$$Fe(B  
Date: Mon, 7 Apr 2008 02:16:38 +0900  
Message-ID: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

> e$B%a!\<%k$r$$$?$@$$$?8e$$$m$$$m9M$($?$N$G$9$,!"e(BString#interne$B$Ke(B  
> e$B$Oe(Btaintede$B%A%'%C%/$OITMW$H$$$&7kO@$K$J$j$^$7$?!#e(B1.9e$B$G$O\<h$j=|e(B  
> e$B$-$^$9!#e(B1.8e$B$G$be(Brb\_sym\_interned\_p(str)e$B$H$b$I$b:o=|$7$F$b$+$^e(B  
> e$B$o$J$$$H;W$$$^$9!#e(B

e$B$“$j$,$H$&$4$6$$$^$9!%e(B  
e$B\<j85$GBP:v$r$”$l$3$l;n$7$F$$$?$s$G$9$,!$$9$Y$F85$KLa$7$^$7$?!%e(B(^\_^)

# e$B$3$l$G\<!$N2]Bj$K?J$a$^$9!%e(B(^\_^;