Tangential observation: Pro forma untainting may be worse than none:
#!/usr/bin/perl -T use 5.016; my $regex = qr/^.*$/; # match anything, including an empty string my @strings = ('delete everything', 'overclock till cpu smokes', 'we ownz you exec(nasty code here)', ' ', '', ); untaint(@strings); sub untaint() { for my $elem(@strings) { if ( $elem =~ /$regex/ ) { say "Thank you, sucker. You are borked, really bad!"; }else{ say "Oh look, untainting did something more than merely al +low any-old-badstruff to pass untaint. string untainted was -|$elem|- +"; } } }
Execution produces:
C:\>untaint-bad.pl Thank you, sucker. You are borked, really bad! |delete everything|' passed. Thank you, sucker. You are borked, really bad! |overclock till cpu smokes|' passed. Thank you, sucker. You are borked, really bad! |we ownz you exec(nasty code here)|' passed. Thank you, sucker. You are borked, really bad! | |' passed. Thank you, sucker. You are borked, really bad! ||' passed.
In reply to Re: Printing regular expression variable
by ww
in thread Printing regular expression variable
by MattLG
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |