Is BigDecimal really not $SAFE?
Why does BigDecimal call SafeStringValue?
irb(main):001:0> $SAFE = 1; BigDecimal.new('1'.taint)
SecurityError: Insecure operation - new
irb(main):001:0> $SAFE = 1; i = '1'.taint.to_i
I think it makes a lot more sense to validate the input within BigDecimal, rather than validate and untaint the string before passing it to BigDecimal.new().
- ext/bigdecimal/bigdecimal.c (BigDecimal_new): stop checking string taintness. [Bug #5508]
#3 Updated by Kenta Murata about 3 years ago
- Status changed from Assigned to Closed
- % Done changed from 0 to 100