Smell the taint
Okay, so I just lost 2 hours of my life that I will never get back do to a Ruby language feature and the built-in rss library's lack of a warning message.
I had a test with a path to an RSS feed,
So I started to isolate the problem. The value coming out of the database looked the same as my test value.... wget, yep it's there....
Wow, there are the same! Why doesn't this work?
So I had to edit rss/parser.rb as root (?!?) to add print statements to isolate where the parser was rejecting the database value... drum roll...
Doh, String values obtained from un-trusted sources such as environmental variables, http requests, or databases are flagged tainted. A tainted string is equal to an untained string if the contents are the same. All I had to do was untaint the string before passing it to the parse method, but yikes.... There goes my 10:1 productivity ratio :)
Taint is a very cool language feature. RSS parse method really should have logged a warning that it ignores tainted sources though!
Okay, so I just lost 2 hours of my life that I will never get back do to a Ruby language feature and the built-in rss library's lack of a warning message.
I had a test with a path to an RSS feed,
RSS:Parser.parse would return a fully populated object, but once I ran the real code it failed.So I started to isolate the problem. The value coming out of the database looked the same as my test value.... wget, yep it's there....
db_value.class # => Stringstr_value.class # => Stringdb_value == str_value # => truedb_value === str_value # => trueWow, there are the same! Why doesn't this work?
So I had to edit rss/parser.rb as root (?!?) to add print statements to isolate where the parser was rejecting the database value... drum roll...
tainted?Doh, String values obtained from un-trusted sources such as environmental variables, http requests, or databases are flagged tainted. A tainted string is equal to an untained string if the contents are the same. All I had to do was untaint the string before passing it to the parse method, but yikes.... There goes my 10:1 productivity ratio :)
Taint is a very cool language feature. RSS parse method really should have logged a warning that it ignores tainted sources though!
Labels: ruby programming wtf

0 Comments:
Post a Comment
Links to this post:
Create a Link
<< Home