Re: hard-to-understand taint error

readdir is an unsafe operation and therefore its results are tainted. grep doesn't clean the tainted data as it will pass on the original data when its value is TRUE. You have to pass the data itself through a regular expression to clean them.

CountZero

A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James

Comment on Re: hard-to-understand taint error Select or Download Code

Replies are listed 'Best First'.
Re^2: hard-to-understand taint error by cmac (Monk) on Feb 18, 2009 at 08:39 UTC
I cooked up a regexp for "how the filenames to be deleted should look" and now the taint checking is happy: `my @dels = (); opendir DIR, DB_DIREC or die "can't open direc ".DB_DIREC.": $!"; for (readdir DIR) { if (/^(__[-!#.0-9@-Z_a-z]+)$/) {push @dels, DB_DIREC."/$1"} } closedir DIR; if (@dels) {unlink @dels}` [download] Thanks for your help, cmac www.animalhead.com	[reply] [d/l]
Re^3: hard-to-understand taint error by ww (Archbishop) on Feb 18, 2009 at 13:23 UTC
That regex won't capture files with UC letters `#!/usr/bin/perl use warnings; use strict; # 744661 my @var = [ 'foo.Bar', 'for.bar', ]; for my $var(@var) { if ( $var =~ /^(__[-!#.0-9@-Z_a-z]+)$/ ) { print "\$var: $var\n"; } else { print "no match!\n"; } }` [download] If you're concerned about files like "foo.Bar", use the /i modifier.	[reply] [d/l]
Re^4: hard-to-understand taint error by ikegami (Patriarch) on Feb 18, 2009 at 14:27 UTC
Not true. `[@-Z]` is an obfuscated way of writing `[\@A-Z]`. Your test fails for two reasons: Your array only contains one element and it's an array reference. Your file names don't start with `__`.	[reply] [d/l] [select]
Re^5: hard-to-understand taint error by ww (Archbishop) on Feb 18, 2009 at 15:56 UTC
Re^6: hard-to-understand taint error by ikegami (Patriarch) on Feb 18, 2009 at 16:19 UTC
Re^3: hard-to-understand taint error by lostjimmy (Chaplain) on Feb 18, 2009 at 14:31 UTC
It looks like your original requirement was files starting with '__'. Similar to what ww is saying, you can simplify your capture to `/^(__.*)$/`; then you won't have to worry about upper-case matching.	[reply] [d/l]
Re^4: hard-to-understand taint error by ikegami (Patriarch) on Feb 18, 2009 at 14:39 UTC
But since we already grepped for `/^__/`, that can be simplified `/^(.*)$/`. Looks scary, but it's fine here. Either we trust `DB_DIREC` or we don't (in which case, it could be used to delete `/etc/__important` even with the "safer" untainting).	[reply] [d/l] [select]
Re^2: hard-to-understand taint error by cmac (Monk) on Feb 18, 2009 at 06:50 UTC
Changed the for statement in the previous sequence to: `for (@dels) {s!(.+)!DB_DIREC."/$1"!e}` [download] Now everything goes through a regular expression and the same error results.	[reply] [d/l]
Re^3: hard-to-understand taint error by CountZero (Bishop) on Feb 18, 2009 at 20:17 UTC
As you have found out yourself, you must take the captured data outside of the regex in order to untaint it. CountZero A program should be light and agile, its subroutines connected like a string of pearls. The spirit and intent of the program should be retained throughout. There should be neither too little or too much, neither needless loops nor useless variables, neither lack of structure nor overwhelming rigidity." - The Tao of Programming, 4.1 - Geoffrey James	[reply]