Re: Why use taint

All incoming data must be taint checked before being used.

I disagree.

Only data that is used in external calls must be taint checked. For example, when a name is put in a cookie, just for fun, there's absolutely no reason to taint check it (you should think about encoding it, though).

I dislike Perl's tainting, because it lets _all_ external input be tainted (and that decreases performance), while some things are never used in a dangerous environment. While it might be a good idea for beginners to always taint everything, I personally HATE -T, and would rather be able to have a lexical taint pragma, and taint and untaint functions for those moments where you want to have a check on some data, or when you know some data is completely safe.

44696420796F7520732F2F2F65206F
7220756E7061636B3F202F6D736720
6D6521203A29202D2D204A75657264

Comment on Re: Why use taint

Replies are listed 'Best First'.
Re: Re: Why use taint by rob_au (Abbot) on Mar 10, 2002 at 01:24 UTC
While not as absolute as a `taint` pragma, the Taint module offers the ability to introduce taint checkpoints in your code. For example: `use Taint; warn "Oops" if tainted $num, @ids; kill $num, @ids;` [download] While not as encompassing as a `taint` pragma, these checkpoints, if placed correctly can tighten up your code without invoking the entire script with the `-T`. The use of this module however does require some forethought and understanding of tainted data and identification of vunerable execution points within your code. `perl -e 's&&rob@cowsnet.com.au&&&split/[@.]/&&s&.com.&_&&&print'`	[reply] [d/l] [select]
Re: Re: Why use taint by no_slogan (Deacon) on Mar 10, 2002 at 02:24 UTC
Only data that is used in external calls must be taint checked. For example, when a name is put in a cookie, just for fun, there's absolutely no reason to taint check it Absolutely no reason to taint check? What if the name they give you contains "\r\n"? If you blindly copied that name into a Set-Cookie header, someone could insert arbitrary HTTP headers and HTML content into your output with a cross-site scripting attack. you should think about encoding it, though Encoding will solve this problem in most cases. CGI.pm automatically url-escapes cookie contents, which is yet another reason to always use it.	[reply]
Re: Re: Re: Why use taint by Juerd (Abbot) on Mar 10, 2002 at 09:33 UTC
As you said, encoding solves the problem. And I don't like CGI.pm, and won't use it unless forced. Not even for cookies, I'd use CGI::Cookie for that, if I have to (note: CGI::Cookies is used by CGI.pm). Or I'd just write a quick-and-dirty regex like `s/(\W)/sprintf "%%%02x", ord $1/ge`. 44696420796F7520732F2F2F65206F 7220756E7061636B3F202F6D736720 6D6521203A29202D2D204A75657264	[reply]


Pathologically Eclectic Rubbish Lister
	PerlMonks