Re^5: Insecure dependency in open while running with -T switch

So now allowed additionally \\ \/ and \s which I need to pass files and parameter into my internal perl script and my CGI started working with -T

sub untainted_string
{
my ($data) = @_;

if ($data =~ /^([-\@\w.\\\/\s]+)$/)
{
        $data = $1;                     # $data now untainted
}
else
{
        die "Bad data in '$data'";
}
return $data;
}
[download]

So where might I be in danger now? Why -T makes my CGI safer?

Comment on Re^5: Insecure dependency in open while running with -T switch Download Code

Replies are listed 'Best First'.
Re^6: Insecure dependency in open while running with -T switch by runrig (Abbot) on Jan 19, 2008 at 01:13 UTC
It used to be more of a problem before 3-arg open (and you are only using two args, so it is a problem). When you include "\|" as the first or last character of a "file name", perl interprets the "file" as a command to run. That's why -T makes your program safer. Even though you could allow "\|" in your file name, it forces you think about such things.	[reply]
Re^7: Insecure dependency in open while running with -T switch by vit (Friar) on Jan 19, 2008 at 01:30 UTC
I tried to convert string to a number using eval() and it worked fine. -T considered it insecure and made me to replace eval() with int() which makes sense in my code logic. But why eval() was insecure? `my $pop_level = int($pop_level1);` [download]	[reply] [d/l]
Re^8: Insecure dependency in open while running with -T switch by CountZero (Bishop) on Jan 19, 2008 at 07:38 UTC
You really have to read `perldoc perlsec` to get a good understanding of what taint mode is and does. The whole idea behind taint is that you are not allowed to do dangerous things with externally supplied data (such as file- or user input). It is called taint as any external data will taint everything else it touches. `eval` is a dangerous operation and `int` is not, so `eval $pop_level1` is not allowed and `int($pop_level1)` is allowed. But try `eval $pop_level` and again you will get the "insecure" error. You have to process all your external data though a regex if you want to use them in dangerous operations. CountZero A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James	[reply] [d/l] [select]