Issue #8161 has been reported by marcandre (Marc-Andre Lafortune).

----------------------------------------
Bug #8161: String#+ should inherit untrustedness
https://bugs.ruby-lang.org/issues/8161

Author: marcandre (Marc-Andre Lafortune)
Status: Open
Priority: Normal
Assignee: 
Category: core
Target version: current: 2.1.0
ruby -v: r39923


As noted by Nikolai Weibull [ruby-core:53679], String#+ doesn't maintain untrustedness.

    s = "foo".untrust
    (s * 2).untrusted? # => true
    (s + s).untrusted? # => false, should be true
    (s + '').untrusted? # => false, should also be true


-- 
http://bugs.ruby-lang.org/