in reply to Re: Re: (ichimunki) Re x3 : disable taint for just one sub
in thread disable taint for just one sub
Looking at the source of Net::Printer, I now see the problem: Line 534 of Printer.pm is our old friend
Where does $this come from? Line 525 packs it, based on the contents of $thisaddr. That variable is set in line 512 from the return values of gethostbyname($hostname), and $hostname is set at line 500 by the insecure code chop ($hostname = `hostname`);.if (!(bind($sh, $this))) { return "Printer: Error: Cannot bind socket: $!\n"; } # if !bind($sh, $this)
It's potentially insecure because it uses a path lookup, and because the value is coming from outside your program. If you're very very sure that hostname will be returning a correct value, you can "untaint" $hostname by the methods discussed in this thread and in perlsec.
Better would be to modify the code to discover the hostname without running another process in backticks.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Re: Re: (ichimunki) Re x3 : disable taint for just one sub
by khippy (Scribe) on Sep 03, 2001 at 16:56 UTC |