As I understand it, taint mode prevents user input ('tainted data') from finding its way to the underlying OS where it might be used to compromise security.

This is meaningful in a web application, where you want to protect your servers from web monkeys trying to poke and prod their way through your application to the OS.

It's not so meaningful in (for example) an installation script, where you want to be able to specify an installation directory (as I did earlier today) and have the script write stuff into that directory.

From an efficiency point of view, I imagine that taint causes Perl to perform more checks, thus it may run more slowly. That's a waste of cycles if such checks aren't required.

This is meaningful in a web application, where you want to protect your servers from web monkeys trying to poke and prod their way through your application to the OS.

s/servers from web monkeys/computers from users/

That's a waste of cycles if such checks aren't required.

"Yeah, some luser stole the CC database, ordered $10_000_000_000 of goods, sold the customer list to spammers and deleted all the real orders, but hey! the application runs 0.002% faster!"

Sorry, I don't agree: if you're dealing with user input in a situation where they could (intentionally or unintentionally*) damage the system and the language offers you a helping hand, why not use it?

I use -T for pretty much anything that's going to be run by anyone except me (I assume I'll supply only valid input -- I'm right _most_ of the time): Like use strict; it helps me write good code, in this case ensuring I validate user input.

* "What due you mean I can't use spaces, (), &, ;, *, ? in filenames?"

-- Sorry if this is abrupt:it's been a rough week!

Sorry, I don't agree: if you're dealing with user input in a situation where they could (intentionally or unintentionally*) damage the system and the language offers you a helping hand, why not use it?

Yes, but that's a far cry from "having it on all the time". Most users cannot (on a proper system) damage the system anyway. It doesn't make sense to have taint checking on oh, say "ls", or "vi" (unless you were to make a restricted shell inside "vi").

And it's not that the language offers you a helping hand free of costs. It's like equiping electronic locks on all the doors in your house - including the doors to any closets, and the lid on your toilet. Locks that can only be unlocked (for one time usage, closing the door auto-locks) by typing in 16 character hex code. Sure, it helps reduce theft from your home. But it isn't very convenient to go from one room to another anymore.

So, the taint really comes into play whenever there is a user interface of some sort. Whether it is web based, curses based, Tk based, etc.

Taint mode would be wasted on non interacting scripts (installation, etc0).. do I have this correct? trying to make sure I understand the reasoning :)

Jason L. Froebe

Team Sybase member

No one has seen what you have seen, and until that happens, we're all going to think that you're nuts. - Jack O'Neil, Stargate SG-1

I don't see much point of using -T on stuff like interactive clients, Tk or not. After all, if the user is going to try to mess with the client, all he can do is screw himself. I make it a point to use it for the server end though, whether it's a CGI script, daemon, Win32 service, or whatnot.

That's not to say that a client program shouldn't be doing any kind of error checking. It should, to some extent. But the server shouldn't depend on that at all, and it should thoroughly check all input in minute detail (which is where taint mode helps out a bit, though it's not 100% foolproof).

Basically, it comes down to this: any code running on a machine which you don't control is code that you can't depend on in terms of security.

You don't want someone to write an ::untaint() sub somewhere and see everyone start using it indiscriminantly, do you?

I'm viewing taint in the same light as 'strict' mode. Sure, it is a PIA to get used to, but it is better... isn't it? ;-)

Based on what I have read so far, I definitely need to start using taint for some of my work.

I'm a bit confused how to set this up though. I can get taint with

perl -T
[download]

There is a taint package on CPAN. But when I try

ppm
install Taint
[download]

Can taint mode only be turned on from the shell with -T? Or does Taint not play nicely with ActiveState and Windows?

You should supply the -T in the shebang line, however if you do so this precludes running the program like:

   perl <scriptname>
[download]

at the command prompt (or elsewhere such as a CGI program on IIS ). There is a small article on overcoming this problem with IIS in the NMS FAQ.

/J\

use strict;
use warnings;
[download]