No, I'd have to edit the module source code because the proper settings for $ENV{PATH} and $ENV{SHELL} are set in one place, my web server, and I have no desire to have 20 CGI scripts with separate, probably out-of-date copies of that configuration information.

If I'm writing a set-UID script, then tainting is correct to tell me that I shouldn't trust PATH nor SHELL (because the user can override these). If you have horrid web server management such that you can't trust these values, then I think your problem is simply "horried web server management". (:

Well, if you want a drop-in replacement, then I'd certainly move away from the @ISA= qw(CGI), change the name, and have users simply add one line to their scripts rather than changing two lines of their scripts.

Please don't use the name "CGI::Safe" unless you address the number one safety problem of CGI: blindly trusting data that comes in over the internet. That is, the "untainting" of CGI parameters. Now, doing that would also justify the @ISA= qw(CGI) design.

The old-style param() method usage could untaint the default way that I described but either a new method or new arguments to param() would allow the coder to specify a regex or subroutine that untaints the data and the module would provide useful templates for common parameter types (like relative paths that don't allow "..").

Actually, I prefer the second option (extending your module). I think it would be great if using CGI::Safe prevented you from ever getting a parameter that didn't match /^\w[-\w.]*\z/ unless you gave it a different specification for that parameter. That would probably do a world of good toward improving CGI code. It would also make using -T easier and would mean that not using -T is no longer a major security error. :)

        - tye (but my friends call me "Tye")

In reply to (tye)Re2: CGI::Safe to CPAN by tye
in thread CGI::Safe to CPAN by Ovid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.