What are tainted objects, and when should we untaint them?

Question

When do Ruby objects need to be made tainted and when should we untaint them? How does the concept of tainted object make a Ruby script run in safe mode? Can anyone elaborate on this to make the concept clear with some code snippets?

Oniskey

Related answer, but not a duplicate question: https://mcmap.net/q/663932/-can-one-use-ruby-safe-level-against-exploits-of-rails-vulnerabilities – Frampton

Can a bit focus on to the question How does the concept of tainted object make a Ruby script run in safe mode?? – Oniskey

Answer 1

What is Tainted?

User input is tainted, by definition. For example:

string = gets
string.tainted?
# => true

You can also manually taint an object.

string = 'Not yet tainted.'
string.tainted?
# => false

(string = 'Explicitly taint me!').taint
string.tainted?
# => true

Why Untaint an Object?

Generally, you would untaint an object only after you validate and/or sanitize it. Untainting an object marks it as "safe" for certain operations that you wouldn't want to run on untrusted strings or other objects, or when your safe level requires an untainted object to perform the desired operation.

Untainting an Object

The easiest way to untaint an object is to call the Object#untaint method on it. For example, if your string variable holds a tainted object, then:

(string = "Let's taint this string!").taint
string.untaint.tainted?
# => false

More About Tainted Objects

You can find out more about tainted objects from the Locking Ruby in the Safe chapter of Programming Ruby.

Frampton

Perfect explanation! +1 to you! but How does the concept of tainted object make a Ruby script run in safe mode? any suggestions on this question? – Oniskey

@PythonLikeYOU I updated the answer to reflect when you might want to untaint an object. By itself, (un)tainting doesn't do anything except change a flag on your object. It really only matters when you're concerned about the safety of your inputs (e.g. SQL injection or #eval methods), or when $SAFE >= 1. – Frampton

has my above asked question(in comment) also answered? I am just wandering in your post! – Oniskey

What does "safe" for certain operations mean? which operations are being referred to here? – Clementeclementi