in reply to Re: inconsistency in untaint
in thread inconsistency in untaint

Also note the error message. You got 'while running with -T switch' which indicates the tainted data where as I'm getting 'while running setuid' which (I believe) indicates something more than standard untaint procedures.

Replies are listed 'Best First'.
Re^3: inconsistency in untaint
by shmem (Chancellor) on Aug 30, 2006 at 18:10 UTC
    Oh, I overlooked that.

    The setuid bit doesn't matter on my system, same result with or without. AFAIK the only difference is that setuid forces the taint flag to be set, otherwise you must set it explicitly.

    What system are you running perl on?

    Tried with a C wrapper around your script as described in perlsec?

    --shmem

    _($_=" "x(1<<5)."?\n".q·/)Oo.  G°\        /
                                  /\_¯/(q    /
    ----------------------------  \__(m.====·.(_("always off the crowd"))."·
    ");sub _{s./.($e="'Itrs `mnsgdq Gdbj O`qkdq")=~y/"-y/#-z/;$e.e && print}
      System: Madriva 2006

      I've had issues with suid scripts before. The application is openwebmail (which I've also added code to in the past). With the exception of File::Path, I've not needed to resort to C wrappers yet. I can patch File::Path for my own use, but I can't offer that back to the the general public as a solution for others. It may be something in the compile flags Mandriva uses for Perl, or maybe even a Perl bug I don't know.

      Still hoping for some kind of flag I can set before calling rmtree() sort it out.