in reply to Re: Re: no PerlIO $ENV{TAINTED};
in thread Perl 5.8.0 PerlIO insecure dependency
And btw, that regex is not bulletproof. "foo and exit" and a whole bunch of other nasties could slip by.
Incorrect. Not unless \w has suddenly started to match spaces rather than just [A-Za-z0-9_]. Please show me *ANY* nasty that will pass through. Without spaces, && || ; , etc you have no statement separator you can get into that eval to let you add to the require.
my @nasties = ( 'foo and exit', "foo\nand\nexit\n", "hello", "foo\000exit", ); for my $layer(@nasties) { print $layer =~ m/^([\w:]+)$/ ? "OK $layer\n" : "ERR $layer\n"; }
cheers
tachyon
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Re: Re: no PerlIO $ENV{TAINTED};
by PodMaster (Abbot) on Apr 13, 2004 at 04:47 UTC | |
by bplatz (Initiate) on Apr 13, 2004 at 12:23 UTC | |
by PodMaster (Abbot) on Apr 13, 2004 at 12:40 UTC | |
by bplatz (Initiate) on Apr 13, 2004 at 17:09 UTC | |
by bplatz (Initiate) on Apr 21, 2004 at 13:31 UTC |