in reply to Reading ENV variable and using that in taint mode

Yes, setting the %ENV values you want to use within the program is exactly how to untaint them. Your method is a little more elaborate than I would usually use, but it looks fine to me.

Rather than arrays, I would probably work directly with the strings. The arrays have some nice features, though.

You can avoid the need to detaint PATH by using the absolute location of /bin/ls, which is unix standard.

After Compline,
Zaxo

  • Comment on Re: Reading ENV variable and using that in taint mode

Replies are listed 'Best First'.
Re^2: Reading ENV variable and using that in taint mode
by sara2005 (Scribe) on Jun 27, 2006 at 23:24 UTC

    I included /bin to $ENV{PATH} in the script but I still got the error

    I still like to use it this way so that I can run some executables by reading from a file

    Any thoughts?

[reply]

      What I meant is that if you say (in the original code) 

      my $runcmd = '/bin/ls -l > test.text';

      [download]
      then you don't have to worry about the taintedness of PATH. It won't be used to find ls.

      After Compline,
      Zaxo

[reply]
[d/l]

        What I meant is that if you say (in the original code)

        my $runcmd = '/bin/ls -l > test.text';

        then you don't have to worry about the taintedness of PATH. It won't be used to find ls.

        Problem is, perl does not know that: 

        sidhekin@blackbox:~$ perl -wT -Mstrict -e 'system("/bin/ls -l")'
Insecure $ENV{PATH} while running with -T switch at -e line 1.
sidhekin@blackbox:~$

        [download]

        In fact, I don't think perl can know what /bin/ls may or may not want to do with PATH. Nor does it matter if the shell is involved in running that command:

        sidhekin@blackbox:~$ perl -wT -Mstrict -e 'system("/bin/ls", "-l")'
Insecure $ENV{PATH} while running with -T switch at -e line 1.
sidhekin@blackbox:~$

        [download]

        So, I'm afraid you'll still have to worry about taintedness of PATH -- and any other "potentially dangerous" environment variable. At least using full path gives you an easy way to deal with tainted PATH: Just delete it!

        sidhekin@blackbox:~$ perl -wT -Mstrict -e 'delete $ENV{PATH}; system("
+/bin/ls", "-l")'
Insecure $ENV{BASH_ENV} while running with -T switch at -e line 1.
sidhekin@blackbox:~$

        [download]

        Um, er, along with every other "potentially dangerous" environment variable, that is ...

        print "Just another Perl ${\(trickster and hacker)},"
        The Sidhekin proves Sidhe did it!

[reply]
[d/l]
[select]

      Include full path

[reply]

In Section Seekers of Perl Wisdom