andreas1234567 has asked for the wisdom of the Perl Monks concerning the following question:

File::Find has an option untaint:
If find is used in taint-mode (-T command line switch or if EUID != UID or if EGID != GID) then internally directory names have to be untainted before they can be chdir'ed to. Therefore they are checked against a regular expression untaint_pattern.
The untaint option works as I expect under Linux, but I can't get it to work under Win32: 
#!perl -T

use strict;
use warnings;
use File::Find;
use File::Spec::Functions;

my $dir = undef;
if ($^O eq q{MSWin32}) {
  $dir = catfile( qw ( C: src perl test untaint ) );
} else {
  $dir = catfile( qw ( / home foo test perl untaint ) );
}

eval {
  find({ wanted => sub { print if -f; }, untaint => 1 }, $dir);
};

print "find died:$@" if ($@);

__END__

C:\src\perl\test\untaint>perl -lT ut.pl
ut.pl
find died:insecure cwd in find(depth) at C:/Perl/lib/File/Find.pm line
+ 747.
C:\src\perl\test\untaint>perl --version

This is perl, v5.8.8 built for MSWin32-x86-multi-thread
(with 50 registered patches, see perl -V for more detail)

Binary build 820 [274739] provided by ActiveState http://www.ActiveSta
+te.com
Built Jan 23 2007 15:57:46

$ perl -lT ut.pl
ut.pl

$ perl --version
This is perl, v5.8.5 built for i386-linux-thread-multi

[download]
Is this a bug?
--
Andreas

Replies are listed 'Best First'.
Re: File::Find untaint in taint-mode under Win32
by tachyon-II (Chaplain) on Dec 20, 2007 at 12:33 UTC

    The untaint option does not work as you expect. If you had continued to read the fine manual immediately after the bit you posted it says:

    Note that all names passed to the user's I<wanted()> function are still tainted.

[reply]

      Yeah, and if you had read the code, you wouldn't have posted a useless comment.

      Anyway, the problem is that the default untaint_pattern is set to qr|^([-+@\w./]+)$| and the cwd on windows most likely contains :, like in C:/some/path.

      So, you have to fix the untaint pattern using something like: untaint_pattern => qr|^([-+@\w./]+)$|

[reply]
[d/l]
[select]
        In the context of your answer the untaint_pattern should probably be: 
            untaint_pattern => qr|^([-+@\w./:]+)$|

        [download]
        Or to allow for Windows style directory separators as well (is that necessary?) something like: 
            untaint_pattern => qr|^([-+@\w./:\\]+)$|

        [download]
        Anyone see any omissions or gotchas here for Windows or other platforms?

        --
        John.

[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom