Ruby in a Nutshell

Name

Level 1

Synopsis

In this level, potentially dangerous operations using tainted data are forbidden. This is a suitable level for programs that handle untrusted input, such as CGI.

• Environment variables RUBYLIB and RUBYOPT are ignored at startup.

• Current directory (.) isn’t included in $LOAD_PATH.

• The command-line options -e, -i, -I, -r, -s, -S, and -X are prohibited.

• Process termination if the environment variable PATH is tainted.

• Invoking methods and class methods of Dir, IO, File, and FileTest for tainted arguments is prohibited.

• Invoking test, eval, require, load, and trap methods for tainted argument is prohibited.