in reply to First Time Untainting Data

Two things: first, your untaint function isn't untainting the data. Removing parts from a tainted string doesn't make it untainted. Match (in parens) what you allow, and use that ($1) - that will be untainted. See the perlsec manual page.

But looking at the rest of the program, I don't think you are doing anything that isn't insecure.

Abigail

Replies are listed 'Best First'.
Re: Re: First Time Untainting Data
by svsingh (Priest) on Oct 10, 2003 at 17:05 UTC
    Thanks for the tip. I rewrote the untaint subroutine as follows (borrowing from perlsec): 
    sub untaint {
   my $s = $_[0];
   if ($s =~ /^([\w \-\@\(\)\,\.\/]+)$/) {
      $s = $1;               # $data now untainted
    } else {
      die "Bad data in $s";  # log this somewhere
    }  
    return $s;
}

    [download]

    When I get home, I'll look into writing a separate untaint subroutine for each field, but is this more correct than the original?

    Thanks again.

[reply]
[d/l]
      This is at least a syntactical valid way of untainting the data, but I do not know whether it's semantically correct. That depends on how the data is used. And do yourself (and all readers of your code), don't backwack everything. Only use a backslash when it's really needed. Like this: 
          if ($s =~ m{^([-\w \@(),./]+)$}) {

      [download]

      Abigail

[reply]
[d/l]

In Section Seekers of Perl Wisdom