Merge pull request #9145 from headius/defensive_fstring

headius · web-flow · commit 3e36f8d7a97d · 2025-12-18T11:54:23.000-08:00
Never trust external content for FString
diff --git a/core/src/main/java/org/jruby/RubyString.java b/core/src/main/java/org/jruby/RubyString.java
@@ -972,7 +972,7 @@ public final RubyString dupAsChilled(Ruby runtime, RubyClass clazz, String file,
 
     public FString dupAsFString(Ruby runtime) {
         shareLevel = SHARE_LEVEL_BYTELIST;
-        FString dup = new FString(runtime, value, getCodeRange());
+        FString dup = new FString(runtime, value.dup(), getCodeRange());
         dup.shareLevel = SHARE_LEVEL_BYTELIST;
         dup.flags |= FSTRING | FROZEN_F | (flags & CR_MASK);
 
