# Taint mechanism

**URL:** <https://www.ruby-forum.com/t/taint-mechanism/141987>\
**Category:** Ruby\
**Created:** [July 2, 2008, 12:50pm UTC](https://www.ruby-forum.com/t/taint-mechanism/141987 "2008-07-02T12:50:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rvork](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/f6c823/32.png) [@rvork](https://www.ruby-forum.com/u/rvork)\
**Post date:** [July 2, 2008, 12:50pm UTC](https://www.ruby-forum.com/t/taint-mechanism/141987/1 "2008-07-02T12:50:18Z")

</div>

Hi everyone,

I would like to ask a few question about the taint mechanism of ruby.

It seems that ruby taint mechanism doesn’t care about indirect dataflow  
to propagate the taint. For instance, if you got :

myVar1 = ARGV[0] \<-- tainted

if myVar1 == “alice”  
myVar2 = “Bob”  
else  
myVar2 = “Eve”  
end

myVar2 should be tainted as there is an indirect dataflow from myVar1,  
which is tainted, to myVar2. So I think it would be of a great thing to  
be able to tackle indirect data flow, in order to be able to “prove”  
some security properties on ruby programs.

Is this a choice from ruby core developers or would it be a potential  
feature for the next ruby version ?

Thanks to all

Olivier

---

<div class="post-metadata">

**Author:** ![rvork](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/f6c823/32.png) [@rvork](https://www.ruby-forum.com/u/rvork)\
**Post date:** [July 2, 2008, 4:52pm UTC](https://www.ruby-forum.com/t/taint-mechanism/141987/2 "2008-07-02T16:52:28Z")

</div>

Hi,

In message “Re: Taint mechanism”  
on Wed, 2 Jul 2008 19:47:21 +0900, Olivier S.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

|It seems that ruby taint mechanism doesn’t care about indirect dataflow  
|to propagate the taint. For instance, if you got :  
|  
|myVar1 = ARGV[0] ← tainted  
|  
|if myVar1 == “alice”  
| myVar2 = “Bob”  
|else  
| myVar2 = “Eve”  
|end  
|  
|myVar2 should be tainted as there is an indirect dataflow from myVar1,  
|which is tainted, to myVar2. So I think it would be of a great thing to  
|be able to tackle indirect data flow, in order to be able to “prove”  
|some security properties on ruby programs.

We are not going to track indirect data flow in the future. Ruby’s  
taint mechanism is a tool to prevent foolish security flaws. We don’t  
need costly data flow analysis for the purpose. Simple direct data  
flow tracking is enough.

```
          matz.

```

---

<div class="post-metadata">

**Author:** ![rvork](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/f6c823/32.png) [@rvork](https://www.ruby-forum.com/u/rvork)\
**Post date:** [July 3, 2008, 3:44am UTC](https://www.ruby-forum.com/t/taint-mechanism/141987/3 "2008-07-03T03:44:01Z")

</div>

Yukihiro M. wrote:

> We are not going to track indirect data flow in the future. Ruby’s  
> taint mechanism is a tool to prevent foolish security flaws. We don’t  
> need costly data flow analysis for the purpose. Simple direct data  
> flow tracking is enough.

For those considering using tainting/SAFE for security, JRuby’s tainting  
is probably not reliable. In general, I believe tainting is a bad  
security mechanism, since it requires a thousand little bits of code all  
over the place to make sure taint propagates correctly and is checked  
when it’s important. JRuby users will probably prefer to lean on Java’s  
security model, which is more coarse-grained and defined in terms of  
classes of operations rather than individual functions. We don’t plan to  
improve taint/SAFE support in JRuby in the future.

- Charlie

---

<div class="post-metadata">

**Author:** ![rvork](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/f6c823/32.png) [@rvork](https://www.ruby-forum.com/u/rvork)\
**Post date:** [July 3, 2008, 11:58am UTC](https://www.ruby-forum.com/t/taint-mechanism/141987/4 "2008-07-03T11:58:14Z")

</div>

Hi,

Well, i understand. It may look like it’s a shame that you can’t assure  
no security properties based on that taint mechanism, but i understand  
how complex nad costly it is to build a reliable indirect dataflow  
analyser.

Nevermind, thanks for your answers and long life to ruby

Olivier