Unfortunately, the Perl executable must be started with taint mode enabled. That means you're going to have to be ultra careful. Taint will not be terribly useful here as you can't use it to taint data unless taint checking is already enabled.

If you can pass control to the other script which is in taint mode, that might be an idea, but it's going to be very slow.

What I try to do in a situation like this is I group all of the scalars that should normally be tainted close to the top of the program and I attempt (if possible), to "untaint" them there. Often, if taint checks are enabled, untainting is scattered throughout the program. If taint checks are not enabled, it's much tougher to easily determine where you want to untaint data. By grouping this data -- and liberally commenting so others understand why it's being done -- you can create a "red flag" for programmers that follow.

I, for one, would KILL to be able to enable taint checking "on the fly," but I suspect that it would not be a trivial task to accomplish.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

In reply to (Ovid) Re: A Quest for Taint by Ovid
in thread A Quest for Taint by andye

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.