Re: Own modules and tainted mode

Most likely you'll fare better by using an absolute path instead of a relative path:

use lib qw(/home/sites/feedback/cgi-bin);
[download]

I think that:

use lib dirname(dirname abs_path $0);
[download]

puts a tainted value into @INC because $0 can be under the control of an attacker (through symlinks or hardlinks).

Comment on Re: Own modules and tainted mode Select or Download Code

Replies are listed 'Best First'.
Re^2: Own modules and tainted mode by haj (Vicar) on May 28, 2018 at 12:25 UTC
Correct: $0 is tainted. `perl -MScalar::Util=tainted -T -e 'print "tainted!\n" if tainted($0)'` [download]	[reply] [d/l]
Re^3: Own modules and tainted mode by PeterKaagman (Beadle) on May 28, 2018 at 13:50 UTC
Suspected $0 to be tainted, so untainted it the quick way `$0 =~ /([\.\/\w]+)/;` [download] and used $1 instead of $0... did not do the trick. I could indeed use an absolute path in the use lib.... but that would make it less portable... it would only work for that location	[reply] [d/l]
Re^4: Own modules and tainted mode by haj (Vicar) on May 28, 2018 at 14:51 UTC
The return values from `Cwd` functions, in your case `abs_path`, are tainted. Compare: `perl -MScalar::Util=tainted -MCwd=abs_path -T -e '$0 =~ /([\.\/\w]+)/; print "tainted!\n" if tainted($1)'` `perl -MScalar::Util=tainted -MCwd=abs_path -T -e '$0 =~ /([\.\/\w]+)/; print "tainted!\n" if tainted(abs_path $1)'` BTW: I find it scary to use taint mode and then allow relative include paths... YMMV.	[reply] [d/l] [select]
Re^4: Own modules and tainted mode by shmem (Chancellor) on May 28, 2018 at 22:53 UTC
I could indeed use an absolute path in the use lib.... but that would make it less portable... it would only work for that location If you want your package to be relocatable, use FindBin. Untaint `$FindBin::Bin` by applying a capturing match in a BEGIN block, and use the result as argument to `use lib;` - e.g. `#!/usr/bin/perl -T # file taint.pl use FindBin; BEGIN { $FindBin::Bin =~ /^([\w\/\.]+)$/ and $FindBin::Bin = $1 } use lib "$FindBin::Bin/tmp"; use Qwargl qw(blorgh); blorgh();` [download] `# file tmp/Qwargl.pm package Qwargl; use 5.10.0; require Exporter; @ISA = qw(Exporter); our @EXPORT_OK = qw(blorgh); sub blorgh { say "strzdiwuddz!"; } "yecch";` [download] Adapt the pattern in the BEGIN block to fit your needs. perl -le'print map{pack c,($-++?1:13)+ord}split//,ESEL'	[reply] [d/l] [select]