Re^2: Using a regex pattern from STDIN

If this script is to be used by other users (besides you), you should be aware that it's dangerous to use user-entered data without untainting it first. Use 'taint' mode by doing

   #!/usr/bin/perl -wT
[download]

the "T" means "T"aint mode - it won't allow you to use any data from outside your program unless you untaint it first.

Comment on Re^2: Using a regex pattern from STDIN Download Code

Replies are listed 'Best First'.
Re^3: Using a regex pattern from STDIN by Limbic~Region (Chancellor) on Jun 21, 2004 at 19:44 UTC
Use 'taint' mode by doing #!/usr/bin/perl -wT That's almost good advice. Adding Taint Checking can't be done on the shebang line because it is already too late. You need to invoke Perl as perl -T from the command line - see perldoc perlsec. I would argue that you should enable Taint Checking even if you are the only one using the code because things change over time and we are all forgetful without our daily dose of caffeine. I would also say that it is pointless to turn on Taint Checking if you aren't going to take the time to perform "good" untainting regexes and just allow everything through anyway. Cheers - L~R Update: Ok, and what I said is almost right. As a a kind monk pointed out to me in a /msg, it does do the "right thing" if it is a CGI or as ./scrip.pl, just not from perl script.pl.	[reply]

Replies are listed 'Best First'.

Re^3: Using a regex pattern from STDIN
by Limbic~Region (Chancellor) on Jun 21, 2004 at 19:44 UTC

Use 'taint' mode by doing #!/usr/bin/perl -wT

That's almost good advice. Adding Taint Checking can't be done on the shebang line because it is already too late. You need to invoke Perl as perl -T from the command line - see perldoc perlsec. I would argue that you should enable Taint Checking even if you are the only one using the code because things change over time and we are all forgetful without our daily dose of caffeine. I would also say that it is pointless to turn on Taint Checking if you aren't going to take the time to perform "good" untainting regexes and just allow everything through anyway.

L~R

Update: Ok, and what I said is almost right. As a a kind monk pointed out to me in a /msg, it does do the "right thing" if it is a CGI or as ./scrip.pl, just not from perl script.pl.

[reply]