Skip to content

Removes taint checking functions #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mhashizume wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Removes taint checking functions #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions pwd/shadow.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,8 @@ static VALUE convert_pw_struct( struct passwd *entry )
{
/* Hmm. Why custom pw_change instead of sp_lstchg? */
return rb_struct_new(rb_sPasswdEntry,
rb_tainted_str_new2(entry->pw_name), /* sp_namp */
rb_tainted_str_new2(entry->pw_passwd), /* sp_pwdp, encryped password */
rb_str_new2(entry->pw_name), /* sp_namp */
Copy link
Owner

@apalmblad apalmblad Dec 15, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mhashizume Does this. need to be wrapped in a macro? Are we losing anythign for older rubies?

Copy link

@joshcooper joshcooper Jan 17, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Core ruby did something similar when switching dir.c to use untainted strings:

ruby/ruby@ffd0820#diff-13026f61c17631884dc4c6ee9128710ef8801844114eaedaf0a13db649b4b0a2

In Ruby 2.7, taint has no effect on strings, and since older rubies are EOL this should be safe.

rb_str_new2(entry->pw_passwd), /* sp_pwdp, encryped password */
Qnil, /* sp_lstchg, date when the password was last changed (in days since Jan 1, 1970) */
Qnil, /* sp_min, days that password must stay same */
Qnil, /* sp_max, days until password changes. */
Expand All @@ -66,7 +66,7 @@ static VALUE convert_pw_struct( struct passwd *entry )
INT2FIX(difftime(entry->pw_change, 0) / (24*60*60)), /* pw_change */
INT2FIX(difftime(entry->pw_expire, 0) / (24*60*60)), /* sp_expire */
Qnil, /* sp_flag */
rb_tainted_str_new2(entry->pw_class), /* sp_loginclass, user access class */
rb_str_new2(entry->pw_class), /* sp_loginclass, user access class */
NULL);
}

Expand Down
4 changes: 2 additions & 2 deletions shadow/shadow.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,8 @@ static VALUE rb_eFileLock;
static VALUE convert_pw_struct( struct spwd *entry )
{
return rb_struct_new(rb_sPasswdEntry,
rb_tainted_str_new2(entry->sp_namp),
rb_tainted_str_new2(entry->sp_pwdp),
rb_str_new2(entry->sp_namp),
rb_str_new2(entry->sp_pwdp),
INT2FIX(entry->sp_lstchg),
INT2FIX(entry->sp_min),
INT2FIX(entry->sp_max),
Expand Down