http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30903&view=revision

diff -Naurp ruby-1.8.7-p249/error.c ruby-1.8.7-p249.oden/error.c
--- ruby-1.8.7-p249/error.c	2008-08-04 03:24:26.000000000 +0000
+++ ruby-1.8.7-p249.oden/error.c	2011-05-23 08:00:51.000000000 +0000
@@ -403,7 +403,6 @@ exc_to_s(exc)
     VALUE mesg = rb_attr_get(exc, rb_intern("mesg"));
 
     if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
-    if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg);
     return mesg;
 }
 
@@ -667,10 +666,9 @@ name_err_to_s(exc)
     if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
     StringValue(str);
     if (str != mesg) {
-	rb_iv_set(exc, "mesg", mesg = str);
+	OBJ_INFECT(str, mesg);
     }
-    if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg);
-    return mesg;
+    return str;
 }
 
 /*
diff -Naurp ruby-1.8.7-p249/test/ruby/test_exception.rb ruby-1.8.7-p249.oden/test/ruby/test_exception.rb
--- ruby-1.8.7-p249/test/ruby/test_exception.rb	2007-02-12 23:01:19.000000000 +0000
+++ ruby-1.8.7-p249.oden/test/ruby/test_exception.rb	2011-05-23 08:00:53.000000000 +0000
@@ -184,4 +184,26 @@ class TestException < Test::Unit::TestCa
       assert(false)
     end
   end
+
+  def test_to_s_taintness_propagation
+    for exc in [Exception, NameError]
+      m = "abcdefg"
+      e = exc.new(m)
+      e.taint
+      s = e.to_s
+      assert_equal(false, m.tainted?,
+                   "#{exc}#to_s should not propagate taintness")
+      assert_equal(false, s.tainted?,
+                   "#{exc}#to_s should not propagate taintness")
+    end
+    
+    o = Object.new
+    def o.to_str
+      "foo"
+    end
+    o.taint
+    e = NameError.new(o)
+    s = e.to_s
+    assert_equal(true, s.tainted?)
+  end
 end