update: I was being a retard.. The session id and the session directory on server needed to be untainted, not for reading, but for writing. duh. so.. I added this:

#......y $DMS = load_nouser(conf=>'/srv/www/htdocs-devel/dms/conf/dms.
+conf');

#init cgi
my $cgi = new CGI;
for ($cgi->param()){    /^session$|^user_file$/ or die("bad field"); }
+ # some minor checking .. make sure no extraneous data send

$$DMS{S}{session} = $cgi->param('session'); $$DMS{S}{session}=~m/^\w{3
+2}$/ or die("no sid [$$DMS{S}{session}] or not 32 word chars");

#################################################################
# I WAS BEING A RETARD: these needed to be untainted... :)
if ($$DMS{S}{session}=~m/(^\w+$)/){
    $$DMS{S}{session}=$1;
} else {die $!;}

if ($$DMS{CONF}{SESSIONS_DIR}=~m/^([\/\w -]+)$/){
    $$DMS{CONF}{SESSIONS_DIR}=$1;
} else {die $!;}
##############################################################

# you dont need to untaint to read, but to write, yes, to the session 
+file
$$DMS{s} = new CGI::Session("driver:File",$$DMS{S}{session},{ Director
+y=> $$DMS{CONF}{SESSIONS_DIR} });
$ENV{REMOTE_ADDR} or die ('no ip');
$ENV{REMOTE_ADDR} eq $$DMS{s}->param('_SESSION_REMOTE_ADDR') or die("b
+ad ip");
# ......

[download]

Now it's happy :).

In reply to Re: problem saving string to cgi::session with Taint by leocharre
in thread problem saving string to cgi::session with Taint by leocharre

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.