GetOptions('b=s' => \$two);
...

./script.pl -b foo
[download]

I'm not sure why your CGI param is not tainted, mine is (CGI.pm version 2.752).

-derby

update: As for the CGI param not being tainted, when you run under "offline mode", CGI reads from STDIN and passes the data to shellwords (shellwords.pl). shellwords parses the passed data via regex and builds the return value via regex matches - effectively untainting the param. As others have shown, by passing the param on the cmdline (instead of offline), shows the param as tainted.

You're right of course. I added the command-line check in quickly later.

Making the change suggested by derby shows $two to be tainted (on one of the systems).

I tested with Sifmole's syntax (previously I'd just used offline mode) and that shows the variable to be tainted.

So this appears to be applicable to just CGI paramater gathering, and only in offline mode. And now derby's provided a nice logical explanation--thanks all!

I'm still not convinced it should be leaving them untainted rather than explicitly retainting them, but at least now I know why this is happening.

(CGI version is 2.56 with perl 5.6.0 and 2.80 with perl 5.7.3, which is the system I tested the second time.)

Update too many updates to mention... this node was almost like the chatterbox.

kudra wrote: I'm still not convinced it should be leaving them untainted rather than explicitly retainting them, but at least now I know why this is happening.

I think you're right. These variables should be left tainted. The following hack will leave them tainted.

sub shellwords {
    package shellwords;
    local($_) = join('', @_) if @_;
    my $tainted = substr $_,0,0 if defined; # give me an tainted empty
+ string
    local(@words,$snippet,$field);

    s/^\s+//;
    while ($_ ne '') {
    $field = '';
    for (;;) {
        if (s/^"(([^"\\]|\\.)*)"//) {
        ($snippet = $1) =~ s#\\(.)#$1#g;
        }
        elsif (/^"/) {
        die "Unmatched double quote: $_\n";
        }
        elsif (s/^'(([^'\\]|\\.)*)'//) {
        ($snippet = $1) =~ s#\\(.)#$1#g;
        }
        elsif (/^'/) {
        die "Unmatched single quote: $_\n";
        }
        elsif (s/^\\(.)//) {
        $snippet = $1;
        }
        elsif (s/^([^\s\\'"]+)//) {
        $snippet = $1;
        }
        else {
        s/^\s+//;
        last;
        }
        $field .= $snippet;
    }
    push(@words, $field);
    }

    # this loop will retaint the variables
    foreach ( @words ) {
        $_ .= $tainted if defined;
    }
    @words;
}
[download]

The only problem with this is that if something calls shellwords.pl with several variables, but only one is tainted, then *all* returned variables will be tainted. Is this a problem? I shouldn't think so, but I'm not sure. Also, who the heck would I submit this to? There's no name in the script and it looks like it's part of the standard distribution.

Update: chromatic suggested that it could be submitted to Perl 5 Porters. Will do.

Update 2: Benjamin Goldberg replied that my goal was good, but suggested using the 're' pragma. I resubmitted the patch to p5p as follows:

--- shellwords.pl.orig  Tue May 21 10:04:07 2002
+++ shellwords.pl       Tue May 21 11:12:45 2002
@@ -17,6 +17,7 @@
     while ($_ ne '') {
        $field = '';
        for (;;) {
+        use re 'taint'; # leave strings tainted
            if (s/^"(([^"\\]|\\.)*)"//) {
                ($snippet = $1) =~ s#\\(.)#$1#g;
            }
[download]

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

Running...
Perl version: 5.006001
Osname: linux
Executable name: /usr/local/bin/perl
+

zot is not tainted
zot is not tainted
123 is tainted
123 is tainted
456 is tainted
456 is tainted
[PATH] is tainted
[PATH] is tainted
[download]

$CGI::revision = '$Id: CGI.pm,v 1.49 2001/02/04 23:08:39 lstein Exp $'
$CGI::VERSION='2.752';
[download]

C:\WINNT\Profiles\CalHenderson\Desktop\lang>perl -T taint.pl a=123 -b 
+456
Running...
Perl version: 5.006001
Osname: MSWin32
Executable name: C:\Perl\bin\Perl.exe

zot is not tainted
zot is not tainted
123 is tainted
123 is tainted
1 is not tainted
1 is not tainted
[path] is tainted
[path] is tainted
[download]

C:\WINNT\Profiles\CalHenderson\Desktop\lang>perl -v

This is perl, v5.6.1 built for MSWin32-x86-multi-thread
(with 1 registered patch, see perl -V for more detail)

Copyright 1987-2001, Larry Wall

Binary build 628 provided by ActiveState Tool Corp. http://www.ActiveS
+tate.com
Built 15:41:05 Jul  4 2001
[download]