in reply to Re: Re: Why do I need -w in a cgi script
in thread Why do I need -w in a cgi script

Let's say, you have the following program:
#!/usr/bin/perl -T use strict; use warnings; my $file = shift; open my $fh => $file or die $!; while (<$fh>) {print} close $fh; __END__

A fairly trivial one. Takes only one parameter. You test it with a million files. It all works fine. You remove the '-T' and put it in production, where it's going to be run suid or called by a CGI program, or whatever.

Then some joker passes "> /some/important/file" as argument. With "-T", perl would not have wiped the content of the file. Without, it will.

Abigail

Replies are listed 'Best First'.
Re: Re: Why do I need -w in a cgi script
by Melly (Chaplain) on Oct 10, 2003 at 14:27 UTC

    I concede! I'm an idiot!

    I'd forgotten (or, more accurately, never noticed) that Taint would allow anything to be done with user-input prior to untainting it with a regex.

    Tom Melly, tom@tomandlu.co.uk
      Taint checking only prevents you from doing *insecure* things. Opening a file for reading isn't insecure - opening a file for writing is. If taint checking would disallow you to do anything, you wouldn't even be able to untaint it.

      Abigail