JRuby

Marshal.dump and Marshal.load do not respect object's taintedness and untrustedness

Details

  • Type: Bug Bug
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: JRuby 1.4
  • Fix Version/s: JRuby 1.5
  • Component/s: Core Classes/Modules, RubySpec
  • Labels:
    None
  • Environment:
    github trunk, Java 6, Mac OS X 10.6.2
  • Number of attachments :
    0

Description

I pushed new specs (see http://github.com/rubyspec/rubyspec/commit/9baa5e7b99dff5be0b574dfa0d1f8db4f3bd9c94) to rubyspec.

The rev introduces a few new failures in JRuby (in addition to ones mentioned in JRUBY-4334 and JRUBY-4335):

1)
Marshal.dump returns a tainted string if object is tainted FAILED
Expected false to be true
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:286
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:12
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:55:in `load'

2)
Marshal.dump returns a tainted string if object is tainted deep in nested structure FAILED
Expected false to be true
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:296
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:12
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/dump_spec.rb:55:in `load'

5)
Marshal::load returns a tainted object if source is tainted FAILED
Expected false to be true
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:331
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:4
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:55:in `load'

6)
Marshal::load preserves taintedness of nested structure FAILED
Expected false to be true
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:347
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:4
/Users/asari/Development/src/jruby/spec/ruby/core/marshal/load_spec.rb:55:in `load'

Activity

Hide
Permalink
Ola Bini added a comment -

Fixed on trunk.

Show
Ola Bini added a comment - Fixed on trunk.

People

  • Assignee:
    Ola Bini
    Reporter:
    Hiro Asari
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: