Re^7: Insecure dependency in open while running with -T switch

I tried to convert string to a number using eval() and it worked fine. -T considered it insecure and made me to replace eval() with int() which makes sense in my code logic. But why eval() was insecure?

 
  my $pop_level = int($pop_level1);
[download]

Comment on Re^7: Insecure dependency in open while running with -T switch Download Code

Replies are listed 'Best First'.
Re^8: Insecure dependency in open while running with -T switch by CountZero (Bishop) on Jan 19, 2008 at 07:38 UTC
You really have to read `perldoc perlsec` to get a good understanding of what taint mode is and does. The whole idea behind taint is that you are not allowed to do dangerous things with externally supplied data (such as file- or user input). It is called taint as any external data will taint everything else it touches. `eval` is a dangerous operation and `int` is not, so `eval $pop_level1` is not allowed and `int($pop_level1)` is allowed. But try `eval $pop_level` and again you will get the "insecure" error. You have to process all your external data though a regex if you want to use them in dangerous operations. CountZero A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^8: Insecure dependency in open while running with -T switch
by CountZero (Bishop) on Jan 19, 2008 at 07:38 UTC

perldoc perlsec

taint

The whole idea behind taint is that you are not allowed to do dangerous things with externally supplied data (such as file- or user input). It is called taint as any external data will taint everything else it touches.

eval is a dangerous operation and int is not, so eval $pop_level1 is not allowed and int($pop_level1) is allowed. But try eval $pop_level and again you will get the "insecure" error.

You have to process all your external data though a regex if you want to use them in dangerous operations.

CountZero

A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James

[reply]
[d/l]
[select]