Asp Forum - dl taint fixes in Ruby 1.8.7-p72 broke Ruby/Tidy

Dmitry Borodaenko

9/20/2008 1:58:00 PM

Greetings,

Since Ruby 1.8.7-p72, I get the following error when using Ruby/Tidy:

SecurityError: Insecure operation - call

Backtrace:
(eval):5:in `call'
(eval):5:in `tidySetErrorBuffer'
/usr/lib/ruby/1.8/tidy/tidylib.rb:102:in `set_error_buffer'
/usr/lib/ruby/1.8/tidy/tidyobj.rb:31:in `initialize'
/usr/lib/ruby/1.8/tidy.rb:36:in `new'
/usr/lib/ruby/1.8/tidy.rb:36:in `new'
/usr/lib/ruby/1.8/tidy.rb:56:in `open'
/usr/lib/ruby/1.8/samizdat/sanitize.rb:106:in `tidy'

The code that calls tidy is as follows:

def tidy(html)
xml = Tidy.open(:output_xhtml => true, :literal_attributes => true,
:tidy_mark => false, :wrap => 0, :char_encoding => 'utf8'
) {|tidy| tidy.clean(html.to_s.untaint) }

xml.taint
end

Is it Ruby/Tidy that is doing something wrong, or is the security fix
in Ruby 1.8.7-p72 (SVN r17872 [0] would be prime suspect) getting
over-zealous?

[0] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revi...

Here are the relevant (or so I think) bits of Ruby/Tidy code:

class Tidyobj
# . . .
def initialize(options=nil)
@diagnostics = Array.new
@doc = Tidylib.create
@errors = Array.new
@errbuf = Tidybuf.new
@outbuf = Tidybuf.new
@options = Tidyopt.new(@doc)
rc = Tidylib.set_error_buffer(@doc, @errbuf.struct)
verify_severe(rc)
unless options.nil?
options.each { |name, value| Tidylib.opt_parse_value(@doc, name, value) }
end
end
# . . .
end

class Tidybuf
extend DL::Importable

attr_reader(:struct)

TidyBuffer = struct [
"TidyAllocator* allocator",
"byte* bp",
"uint size",
"uint allocated",
"uint next"
]

def initialize
@struct = TidyBuffer.malloc
end
# . . .
end

--
Dmitry Borodaenko

2 Answers

Nickname unavailable

12/23/2012 6:29:00 AM

On Dec 22, 10:59 pm, Bret Cahill <Bret_E_Cah...@yahoo.com> wrote:
> Basically Boehner will cave on spending cuts because it's popular and
> Obama will cave on tax hikes because caving comes naturally for Obama.
>
> Bret Cahill

http://www.huffingtonpost.com/robert-scheer/crony-capitalisms-power-c_b_23...

Robert Scheer
Editor, Truthdig.com; Author, 'The Great American Stickup'

Crony Capitalism's Power Couple
Posted: 12/21/2012 7:15 am

Where is Phil Gramm hiding? The former Republican senator from Texas,
who wrote the radical banking deregulation of the 1990s and was
rewarded for his efforts to enrich the banks with a plum job at
Switzerland-based UBS, has not been heard from since his bank got
nailed by the G-men. Or, as the New York Times put it, UBS now has the
distinction of being "the first big global bank in more than two
decades to have a subsidiary plead guilty to fraud."??Surely Gramm,
who retired from the bank last year, must know something about the
nefarious activities conducted over a timespan when he was helping to
manage the firm. This latest scandal, involving the rigging of a major
trusted banking interest rate, might finally test the theories that he
has long written into law that assume banks are best when regulated by
themselves -- a now obviously dumb idea.
As the Wall Street Journal reported on Thursday: "U.S., U.K. and Swiss
authorities alleged a vast conspiracy led by UBS AG to rig interest
rates tied to trillions of dollars in loans and other financial
products, indicating the practice was far more pervasive than
previously known." But what did Gramm know about this criminal
behavior at a bank he helped govern, and when did he know it?
In a deal brokered with the criminal division of the U.S. Justice
Department, UBS was also fined $1.5 billion in the massive Libor
interest-rate-fixing scam that evidenced a pattern of deep corruption
across a score of top banks. But Gramm, the man most responsible for
the repeal in 1999 of 60 years of sensible banking regulation that
enabled the financial industry to run wild, has not responded to a
single question from the mainstream media concerning UBS' criminal
behavior. I assume he has been queried, given his important prior
contribution to the sorry state of banking.
When Gramm was still at the bank, his bio page on the UBS website paid
tribute to his prior achievements in government: "As chairman of the
Banking Committee, Sen. Gramm steered through legislation modernizing
the nation's banking, insurance and securities laws."
That "modernization" in 2000 made legal the mergers that created the
too-big-to-fail banks that had to be bailed out by taxpayers, as well
as insuring that the burgeoning markets in toxic derivatives and
credit default swaps were summarily freed from all government
regulation. Bill Clinton signed off on the new laws, and his
successor, George W. Bush, enthusiastically enforced them.
How fitting then to find the two presidents united again on several
occasions documented on the UBS website participating in bank-
sponsored panels on "Revitalizing America." Clinton's foundation has
partnered with UBS in mentoring small businesses in poorer
communities, the very communities hit hardest by the banking
shenanigans of the past decade. Ever the optimist, Clinton promised
that "Our partnership with UBS Wealth Management Americas will give
these businesses essential new opportunities to expand and to make a
positive difference in underserved communities." With friends like
these...
The cozy bipartisan reunion of Gramm with the two presidents under the
auspices of UBS goes a long way toward explaining the source of our
economic misery. It would be instructive to now ask all three whether
the crimes of UBS had been enabled by their own actions while they
were still running the U.S. government.
That is why I assume the normally loquacious Gramm is on the lam, or
surely we would have heard from him by now, at least on the Fox News
Channel that has been so solicitous of his wisdom in the past. But not
just on Fox. Gramm and his wife Wendy, who was rewarded with a
position on Enron's board of directors after her own stint in
government undermining consumer protections, were the high priest and
priestess of the religion of radical deregulation that captivated U.S.
presidents from Ronald Reagan through Bill Clinton and on to George W.
Bush.
Or does Gramm still blame the economic crash on those of us he
condemned as "a nation of whiners," a statement that caused his
ejection from a leading role in the 2008 presidential campaign of Sen.
John McCain?
If Phil Gramm were to feign ignorance in response to that line of
questioning, the way Wendy did after the caper at Enron, where she was
a member of the audit committee, it would certainly make the case for
ever more government supervision of corporate accountability.
This was, after all, one of the most powerful couples to ever swirl
through the platinum revolving door between the highest level of
government and corporate power, an exhibit of crony capitalism
performed with such exquisite finesse, and yet wild abandonment, that
it can almost be considered kinky in its indifference to real world
outcomes.

Bret Cahill

12/23/2012 7:01:00 PM

> > Basically Boehner will cave on spending cuts because it's popular and
> > Obama will cave on tax hikes because caving comes naturally for Obama.
>
> > Bret Cahill
>
> yep, with neo-liberals like clinton and obama,

Clinton vetoed Newt's cuts for a high tax economic boom and became the
most popular former president because of that. Clinton enjoyed every
second of Republicans' foaming at the mouth response.

Obama wants to extend oilve branches to everyone so Americans will
become kissey kissey. Some believe it's because Obama has lived in
societies where the *espirit general* isn't based on the western
"robust wide open debate" but some vague concensus culture.

Actually Obama does it because most Americans think a robust wide open
debate only applies to 3rd trimester abortions, gay this gay that and
gun control.

Obama's caving just infuriates the already livid tire biters who are
mostly posturing about tax cuts for the rich.

In some ways Obama is almost worth all the caving to ruinous GOP
economic policies.

> no wonder so many are
> confused in this nation.

It's the 0.01% media that has 'em confused.

Everyone shops online today so any revenue the _New York Times_ gets
from "advertising" is purely for editorial control by for and of the
0.01%.

Before Craig's list at least newspapers got 40% of their revenue from
the general public in the form of want ads. Now it's 100% corporate
money.

Try to remember, _Times_ writers work at will like a IHOP dishwasher
or any other low skill employee. They can get fired that day if they
don't issue fatwahs against any national Democrat who utters the word
"idea."

There's the problem right there.

> i see clintons pal phil grahmm is no where to
> be found after his banks indictment. and clinton and his buddy phil
> were so worried about the poor.

Black family income soared under Clinton and collapsed under Obama.

Tocqueville was clear that the vices and insider trading of
politicians were not and could not ever be a threat to the general
prosperity of the U. S.

Then he offered the greatest indictment ever against aristocracy:

The prince can have every virtue and still ruin his country while
elected politicians can have every vice and the democracy will still
flourish.

The problem isn't Obama but the legacy media working at will for the
0.01%

Bret Cahill

comp.lang.ruby

dl taint fixes in Ruby 1.8.7-p72 broke Ruby/Tidy

Dmitry Borodaenko

Nickname unavailable

Bret Cahill

x Login to ForumsZone