Bug #14075: File.dirname("path without dir".taint) returns untainted string

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 2.3: UNKNOWN, 2.4: UNKNOWN

[znz (Kazuhiro NISHIYAMA)]

Is this intentional?

% ruby -e 'p [File.dirname("foo/bar".taint).tainted?, File.dirname("hoge".taint).tainted?]'
[true, false]

[hkdnet (Ko Sato)]

I found that File.split also returns untainted string with a tainted argument.

$ ruby -e 'p File.split("foo/bar".taint).map(&:tainted?); p File.split("hoge".taint).map(&:tainted?)'
[true, true]
[false, true]

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

I think it is intended.
dirname for a path without directory is ".", and this does not come from the argument string.