in reply to Re: Insecure dependency in open while running with -T switch
in thread Insecure dependency in open while running with -T switch

Got it, Thank you very much
  • Comment on Re^2: Insecure dependency in open while running with -T switch

Replies are listed 'Best First'.
Re^3: Insecure dependency in open while running with -T switch
by vit (Friar) on Jan 18, 2008 at 23:50 UTC
    Acually I have one more question. My file is a path to file like /yyy/xxx/file.txt
    Symbol "/" or "\" is always tainted as far as I understand. Untainting just file.txt is not enough.
    So what to do?
[reply]
      Symbol "/" or "\" is always tainted as far as I understand.
      You understand incorrectly. "/" and "\" is fine if that is what you allow in your regular expression to untaint the data.
[reply]
        So now allowed additionally \\ \/ and \s which I need to pass files and parameter into my internal perl script and my CGI started working with -T 
        sub untainted_string
{
my ($data) = @_;

if ($data =~ /^([-\@\w.\\\/\s]+)$/)
{
        $data = $1;                     # $data now untainted
}
else
{
        die "Bad data in '$data'";
}
return $data;
}

        [download]
        So where might I be in danger now? Why -T makes my CGI safer?
[reply]
[d/l]

In Section Seekers of Perl Wisdom