Rachyl has asked for the wisdom of the Perl Monks concerning the following question:

I have a huge code base of mod_perl using Template Toolkit for the front end, it's been updated with feature adds, etc almost once a week for 2 years now. In November, started getting these errors:

Fri Nov 18 11:19:01 2005:9443:/usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi/Template/Document.pm:82: Insecure dependency in eval while running with -T switch at /usr/lib/perl5/site_perl/5.8.5/i386-linux-thread-multi/Template/Document.pm line 82.

They affect exactly one pid every time, and only happpen once, at most twice, a week, on a system that constantly has dozens of active children.

I've looked at everything a hundred times, all parameter input is scrubbed, no piece of code uses a particularly different mode of doing it than another, and that logic was not new anytime near that date.

Those who've helped me look are all stumped, but there is one guess we're left with which is proving very difficult to test or mitigate (as have all theories, we've never been able to reproduce the error with anything we've tried). That is that one of the scripts allows for an image to be uploaded, the form is TT, the module for turning the input into a binary stream is ImageMagik, and its turned into a binary string for being sent via XML to a separate server.

Does any of this ring a bell for anyone? Is the commbination of technologies and ImageMagik's temp file & binary string triggering the Taint failure?

Any thoughts, even if they are "Nope, you're looking in entirely the wrong place" would be greatly appreciated.

Thanks,
Rachyl

Replies are listed 'Best First'.
Re: TT and Taint
by PodMaster (Abbot) on Feb 18, 2006 at 08:07 UTC
    Can't you track down which particular template is failing (turn debugging on)?
    You could check all templates modified since November.
    Which version of TT do you have?

    MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
    I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
    ** The third rule of perl club is a statement of fact: pod is sexy.

[reply]
Re: TT and Taint
by Anonymous Monk on Feb 18, 2006 at 11:10 UTC
    So the offending lines are these: 
    # DON'T LOOK NOW! - blindly untainting can make you go blind!
$block =~ /(.*)/s;
$block = $1;
        
$block = eval $block;      <-- this line here
return $class->error($@)
     unless defined $block;

    [download]
    The Template Toolkit works by processing the template file and turning it into a bunch of Perl code which this eval then compiles. It also caches this generated Perl code to disk as long as the original template files don't change. Hence the untainting above.

    But since we're blindly untainting, I can't see how we can have the problem that you're describing. It shouldn't happen. No sir.

    I call bug in perl.

[reply]
[d/l]

Back to Seekers of Perl Wisdom