At the current rate it won't even help you make it secure because you are just going to ignore it. :-(

Let me put it this way.

If your process is truly secure because it is jailed and it is behind an SSL apache password protected site, then you should be able to convince your administrators that allowing you to avoid taint checking is OK. That is a site administrator decision.

If the administrators will not allow you to turn it off, they probably have reasons. They know your setup better than I do, and probably better than you do as well. What reasons you ask? Well they may be aware of security issues which you are not. For instance the chroot jail may be breakable by standard cracking tools. Perhaps you are connecting to a database that needs to be protected. Now you trust your users. But perhaps they do not trust users of the site to use good passwords. Or they may be afraid that users are coming from compromised machines.

Depending what you are doing these concerns may be real and valid.

Here is what I know.

Taint checking is a matter of your site's policy. It would be unethical for Randal, or me, to tell you how to violate that site policy.

I am trying to help you. I really am. I am trying to help you with what I see as the most important problem that you have. IMHO that problem is that you do not seem to understand that your corporate security policy has a reason for existing. It is not your place to decide for your company that you don't need to follow policy. It is not my place to tell you how to open your company up to attacks that they know about and are trying to prevent.

Now your company may have a bunch of fascist morons dictating security. If so then that is an internal problem. Complain. But don't ask others to help you get into trouble.

In reply to Re (tilly) 9: CGI::param wrapper for untainting by tilly
in thread CGI::param wrapper for untainting by dcardamo

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.