in reply to Re: Why do I need -w in a cgi script
in thread Why do I need -w in a cgi script
I tentatively disagree
Once you have verified that your script runs with taint-checking, then taint-checking serves no further purpose
To correct your analogy, taint-checking is the irritating voice that tells you when your seat-belt is undone - once you fasten your seat-belt, this voice should not utter another word, and therefore what would be the difference if you turned it off entirely?
I would agree that it would be possible to write a script that would be vulnerable if taint-checking was disabled, but that would imply a faulty script and/or testing process (e.g. you never bothered to test the script using all available params)
Once more with feeling - taint-checking doesn't make your data 'safe' - it just prevents your script from processing unsafe data. The mechanisms you place in your script to make data 'safe' will still be present irrespective of whether taint-checking is on or off
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Why do I need -w in a cgi script
by Abigail-II (Bishop) on Oct 10, 2003 at 12:25 UTC | |
by Melly (Chaplain) on Oct 10, 2003 at 12:50 UTC | |
by Abigail-II (Bishop) on Oct 10, 2003 at 12:55 UTC | |
by Melly (Chaplain) on Oct 10, 2003 at 13:24 UTC | |
by Abigail-II (Bishop) on Oct 10, 2003 at 13:48 UTC | |
|