in reply to -T switch & untaint - how to resolve errors?

You decide what values you expect in $file and $directory and then "launder" them using a regex capture that matches that expectation...

So for example, if $file should be a "word"1... 

my ($untained_file) = $file =~ /^(\w+)$/ or die "bad filename: $file";

[download]

1. A word in this context means a string made up of characters a-z, A-Z, 0-9 and _.

Replies are listed 'Best First'.
Re^2: -T switch & untaint - how to resolve errors?
by Stenyj (Beadle) on Apr 10, 2005 at 17:38 UTC
    I actually found & am using the exact code you suggested: 
        untaint($name);
    untaint($siteName);
    open (FILE,">/$directory/tmpl/$name.tmpl");
        print FILE $content;
    close(FILE);

sub untaint {
    my $var = $_[0];
    unless ($var =~ m/^(\w+)$/) { #allow filename to be [a-zA-Z0-9_]
        die("Tainted");
    } 
    return $var;
}

    [download]
    But I still get the error. Is the switch suppose to be turned off & it's purpose simply to make me aware that this issue needs to be addressed, or am I coding it incorrectly & thus not allowing the switch to realize that I'm untainting the data?

    Thx for the feedback!


    Stenyj
[reply]
[d/l]
      You're not untainting the variable in-place, your call to the function should read as follows: 
          $name = untaint($name);
    $siteName = untaint($siteName);
    open (FILE,">/$directory/tmpl/$name.tmpl");
        print FILE $content;
    close(FILE);

sub untaint {
    my $var = $_[0];
    unless ($var =~ m/^(\w+)$/) { #allow filename to be [a-zA-Z0-9_]
        die("Tainted");
    } 
    return $var;
}

      [download]
      I've asked a question about another topic here, but I think you can find the answers quite useful for your tainting doubts.

      Flavio (perl -e "print(scalar(reverse('ti.xittelop@oivalf')))")

      Don't fool yourself.
[reply]
[d/l]
        Yeah sorry, I fixed the coding after posting, and forgot to update it here.

        Still getting the error, even with the adjusted code.

        "print() on closed filehandle FILE at file.cgi line 117."

        Kind of weird, but tryin' to figure it out.


        Stenyj
[reply]
      Nevermind, I tried exactly your code (rather then my variation of it) and it seems to work (at least the untain part of it):

          my ($untained_file) = $name =~ /^(\w+)$/ or die "bad filename: $na
+me";
    open (FILE,">c:/apache/htdocs/directory/tmpl/$untained_file.tmpl")
+;
        print FILE $content;
    close(FILE);

      [download]

      but oddly, now I'm getting:
      print() on closed filehandle FILE at filename.cgi line 117. on the:
      print FILE $content;

      [download]
      line.

      Will mess around with it, and see if I can figure out what's up.

      Thx again.
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom