70's futuristic technology

Programming focused drivel

Friday, July 13, 2007

Smell the taint
Okay, so I just lost 2 hours of my life that I will never get back do to a Ruby language feature and the built-in rss library's lack of a warning message.

I had a test with a path to an RSS feed, RSS:Parser.parse would return a fully populated object, but once I ran the real code it failed.

So I started to isolate the problem. The value coming out of the database looked the same as my test value.... wget, yep it's there....

db_value.class # => String
str_value.class # => String
db_value == str_value # => true
db_value === str_value # => true
Wow, there are the same! Why doesn't this work?

So I had to edit rss/parser.rb as root (?!?) to add print statements to isolate where the parser was rejecting the database value... drum roll... tainted?

Doh, String values obtained from un-trusted sources such as environmental variables, http requests, or databases are flagged tainted. A tainted string is equal to an untained string if the contents are the same. All I had to do was untaint the string before passing it to the parse method, but yikes.... There goes my 10:1 productivity ratio :)

Taint is a very cool language feature. RSS parse method really should have logged a warning that it ignores tainted sources though!

Labels:

0 Comments:

Post a Comment

Links to this post:

Create a Link

<< Home