in reply to Re: no PerlIO $ENV{TAINTED};
in thread Perl 5.8.0 PerlIO insecure dependency

That's kind of not the point, I think the value should remain tainted and the user should be made to untaint. A patch of $layer =~ s/[^\w:]//g; would take care of that.

And btw, that regex is not bulletproof. "foo and exit" and a whole bunch of other nasties could slip by.

MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
** The third rule of perl club is a statement of fact: pod is sexy.

Replies are listed 'Best First'.
Re: Re: Re: no PerlIO $ENV{TAINTED};
by tachyon (Chancellor) on Apr 13, 2004 at 04:17 UTC

    And btw, that regex is not bulletproof. "foo and exit" and a whole bunch of other nasties could slip by.

    Incorrect. Not unless \w has suddenly started to match spaces rather than just [A-Za-z0-9_]. Please show me *ANY* nasty that will pass through. Without spaces, && || ; , etc you have no statement separator you can get into that eval to let you add to the require.

    my @nasties = ( 'foo and exit', "foo\nand\nexit\n", "hello", "foo\000exit", ); for my $layer(@nasties) { print $layer =~ m/^([\w:]+)$/ ? "OK $layer\n" : "ERR $layer\n"; }

    cheers

    tachyon

      Thanks *cough* I must visit my eye doctor tomorrow *cough*cough* but it doesn't allow PerlIO::don't *cough*duck*

      MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
      I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
      ** The third rule of perl club is a statement of fact: pod is sexy.

        Thank you again folks for your feedback; however, I am looking for a solution that does not modify Perl 5.8.x. I don't want to support a custom patch against the core product. My guess is that this is something that the folks working on the core product are going to have to repair, and for now I'm stuck with "#!/bin/perl -U". Thanks again for your help! Peace.