I'm writing an application that keeps track of contact information for my cousins. I just finished the part that updates the data file based on input into a form.

I'd like to ensure my data isn't tainted and the script isn't exploitable. After reading Untainting Safely and Ovid's CGI Tutorial, I came up with the code at the end of this posting.

If it's not too much touble, can I get some comments on my first attempt at untainting data. Am I missing anything or doing anything risky?

Thanks for your help. 

#!/usr/local/bin/perl -wT
.
.
.
sub saveChanges {
   sub untaint {
      # remove any characters except those listed in regex            
+       
      my $s = $_[0];
      $s =~ s/[^\w \-\@\(\)\,\.\/]//g;  # untaint the data
      return $s;
   }

   # only put valid keys in the hash
   my %c = ();
   my @keys = qw(name birthday email phone cell addr1 addr2 ICQ AIM MS
+N Y!);
   foreach my $i (@keys) {
      if ( defined param("$i") && !param("$i") =~ /^\s*$/ ) {
         $c{$i} = untaint( param("$i") );
      }
   }

   # update datafile
   my $tmpFile = $$config{"data"} . ".tmp";
   open (TFILE, ">$tmpFile") or die "Can't open file: $!\n";
   flock (TFILE, 2) or die "Can't lock file: $!\n";
      my $cousins = &readData();  # read the current datafile
      foreach my $cousin ( keys %$cousins ) {
         if ( $cousin eq $c{"name"} ) { $$cousins{"name"} = \%c; }
         print TFILE "\nname :: $cousin\n";
         foreach my $field ( keys %{$$cousins{$cousin}} ) {
            print TFILE "$field :: $$cousins{$cousin}{$field}\n";
         }
      }
   flock(TFILE, 8);
   close(TFILE);
   rename( $tmpFile, $$config{"data"} );
}

[download]

Update: Added first line of the script to the code block. I'm assuming the -T argument runs the script in taint mode.

In reply to First Time Untainting Data by svsingh

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.