chromatic recently tweeted the question:
"Should Modern::Perl enable taint mode? (If so... hm, how do I do it?)"
...which surprised me, as I tend not to use taint mode.
"Yes, yes, taint mode is crucial. There's rarely a reason NOT to use it."
...which surprised me even more.
I tried using taint mode throughout my application at one stage, but found myself naively untainting paths with
($path) = ($path=~/(.+)/)
which kinda defeats the purpose. Almost always, I found that the stuff I was untainting would have required root access to mess with anyway, and so I gave up on taint mode. The places where exploits were possible, I added relevant code to deal with those particular situations, and all data coming from the user gets validated.
Of course, I may have missed some situations. Maybe I'm being naive. But is enabling taint mode by default the answer to that? Doesn't it mean that, for most people, their code will just fill up with:
$path = untaint($path)
What do you think? To taint or not to taint?
Clint
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: To taint or not to taint?
by moritz (Cardinal) on Mar 19, 2009 at 13:39 UTC | |
Re: To taint or not to taint?
by tilly (Archbishop) on Mar 19, 2009 at 15:25 UTC | |
by clinton (Priest) on Mar 19, 2009 at 15:34 UTC | |
by tilly (Archbishop) on Mar 19, 2009 at 15:40 UTC | |
by clinton (Priest) on Mar 19, 2009 at 15:44 UTC | |
by tilly (Archbishop) on Mar 19, 2009 at 15:46 UTC | |
Re: To taint or not to taint?
by JavaFan (Canon) on Mar 19, 2009 at 21:18 UTC | |
Re: To taint or not to taint?
by SFLEX (Chaplain) on Mar 21, 2009 at 11:48 UTC | |
Re: To taint or not to taint?
by ELISHEVA (Prior) on Mar 22, 2009 at 06:18 UTC | |
Re: To taint or not to taint?
by DeadPoet (Scribe) on Mar 22, 2009 at 00:57 UTC |