# Why does fileno() flag '-' as tainted and not other values? Surely it's not testing the values before testing for taintness?
I don't think so, but I didn't look too hard :) http://perl5.git.perl.org/perl.git?a=search&h=HEAD&st=grep&s=fileno

Is there a scenario where CGI could mess with the application file handles (or at least die again) because of particular values in the URL?
No.

This strikes me needless code execution at best, and as a major security risk at worse. How has it been allowed to slip by without anyone noticing?
Congratulations, you're the first(?) to notice :)

Its not exactly needless (lets just say CGI is complicated), and its not really a security risk, but you could argue it is a bug in perl-5.10.0 


C:\>perl  -e "warn 1;warn fileno shift" -
1 at -e line 1.
Warning: something's wrong at -e line 1.

C:\>perl  -Te "warn 1;warn fileno shift" -
1 at -e line 1.
Insecure dependency in require while running with -T switch at -e line
+ 1.
BEGIN failed--compilation aborted.

C:\>more -
die 666

C:\>perl -e"require '-'
666 at - line 1.
Compilation failed in require at -e line 1.

C:\>perl -e"require shift" -
666 at - line 1.
Compilation failed in require at -e line 1.

C:\>perl -Te"require shift" -
Insecure dependency in require while running with -T switch at -e line
+ 1.

C:\>

[download]
You can see the taint error message is total nonsense (there is no require being performed). I get no error with ActivePerl-5.8.9.825 , ActivePerl-5.8.4.810.

A good alternative to CGI is CGI::Simple

In reply to Re: fileno, taint and CGI.pm by Anonymous Monk
in thread fileno, taint and CGI.pm by ruzam

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.