in reply to Re: Re: Why do I need -w in a cgi script
in thread Why do I need -w in a cgi script
Taint checking is a security tool, not a development tool. Unless security is unimportant in production, do not remove it.
Oh? I know it's a run-time mechanism, but I was under the impression that if you were doing anything unsafe with tainted data, a reasonable amount of testing would flush that out, and you'd fix it, and subsequently you would not be doing unsafe things with tainted data, provided the script and the taintedness of its data don't change and that you tested all the code pathways in testing. I've been leaving it turned on, because not forgetting to turn it back on if I make changes is more important to me than performance, but I'd be interested in an explanation of how my thinking in this area is mistaken.
$;=sub{$/};@;=map{my($a,$b)=($_,$;);$;=sub{$a.$b->()}} split//,".rekcah lreP rehtona tsuJ";$\=$ ;->();print$/
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Why do I need -w in a cgi script
by Juerd (Abbot) on Oct 09, 2003 at 21:20 UTC |