ncw has asked for the wisdom of the Perl Monks concerning the following question:
I've noticed that File::Find doesn't work under
taint checks. Eg :-
A bit of rooting about in the source code comes up with the problem - File::Find uses Cwd::cwd which produces tainted results. Eg:-#!/usr/bin/perl -wT use strict; use File::Find; $ENV{PATH} = "/bin:/usr/bin"; $ENV{ENV} = ""; # This produces "Insecure dependency in chdir while running with -T # switch" find( sub { print }, "." );
Now I can see that it might be advantageous for setuid scripts to think that cwd() returns tainted data, but unfortunately this means that is isn't possible to use File::Find with -T set because the call to Cwd is internal to File::Find and can't be monkeyed with.#!/usr/bin/perl -wT use strict; use Cwd; $ENV{PATH} = "/bin:/usr/bin"; $ENV{ENV} = ""; # This produces "Insecure dependency in system while running with -T # switch" system "ls " . cwd();
Any ideas on how to get around this?
PS This may be a un*x only problem I don't know. I tested this with 5.005_03 on linux.
PPS The code for Cwd::cwd() looks like chop(`pwd`) which is rather unpleasant in my opinion because it is calling the shell which starts another process, takes time etc. (Remove the PATH in the Cwd example above and it will fail with can't find pwd!)
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: Taint checking
by merlyn (Sage) on Sep 25, 2000 at 17:11 UTC | |
by ncw (Friar) on Sep 25, 2000 at 21:48 UTC | |
Re: Taint checking
by t0mas (Priest) on Sep 25, 2000 at 16:57 UTC | |
/bin/pwd (Re: Taint checking)
by tye (Sage) on Sep 25, 2000 at 20:39 UTC | |
by ncw (Friar) on Sep 25, 2000 at 22:12 UTC |
Back to
Seekers of Perl Wisdom