> but ruby doesn't track external strings as dirty like that.
Yes, it does. E.g:
x = STDIN.gets
puts x.tainted?
y = "hello "+x
puts y.tainted?
z = "foo"
puts z.tainted?
The two first will return "true", and the last will print "false". If you set the safe-level appropriately some methods will be disallowed for x and y above (e.g. eval()), though I would not trust that as comprehensive, but it's a lot better than nothing.
Yes, it does. E.g:
The two first will return "true", and the last will print "false". If you set the safe-level appropriately some methods will be disallowed for x and y above (e.g. eval()), though I would not trust that as comprehensive, but it's a lot better than nothing.