Re^4: Tainting problem on Strawberry perl

Wow you found it, in that you made a test, I guess it has nothing to do with a being tainted, I'll rename node. That is correct with your code, I get what you've assumed I would get.

Evan Carroll
www.EvanCarroll.com

Comment on Re^4: Tainting problem on Strawberry perl

Replies are listed 'Best First'.
Re^5: Tainting problem on Strawberry perl by ikegami (Patriarch) on Feb 28, 2008 at 23:33 UTC
Some more (speculation) on the subject: `$wdir =~ s[:][]g;` can probably be removed from the test. I didn't want to remove too much, but I don't see how this could possibly trigger the bug. So really, the minimal test is probably `use File::Spec::Win32; my $wdir = 'C/strawberry'; $wdir =~ /(.*)/; print File::Spec::Win32->catfile('C:/cache', $1), "\n";` [download] The "`C:`" being appended probably comes from $cdir. The last regexp to successfully match in `catfile` is `$path =~ s/^([a-z]:)/\u$1/s;` (via `canonpath` via `catdir`), where path is a copy of $cdir. That would explain why `$1` has been changed but not how it managed to get appended. I wouldn't mind having a look at your `File/Spec/Win32.pm`, specifically `catfile`.	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^5: Tainting problem on Strawberry perl
by ikegami (Patriarch) on Feb 28, 2008 at 23:33 UTC

Some more (speculation) on the subject:

$wdir =~ s[:][]g; can probably be removed from the test. I didn't want to remove too much, but I don't see how this could possibly trigger the bug. So really, the minimal test is probably
```
use File::Spec::Win32;
my $wdir = 'C/strawberry';
$wdir =~ /(.*)/;
print File::Spec::Win32->catfile('C:/cache', $1), "\n";
[download]
```
The "C:" being appended probably comes from $cdir. The last regexp to successfully match in catfile is $path =~ s/^([a-z]:)/\u$1/s; (via canonpath via catdir), where path is a copy of $cdir.

That would explain why $1 has been changed but not how it managed to get appended. I wouldn't mind having a look at your File/Spec/Win32.pm, specifically catfile.

[reply]
[d/l]
[select]