Beefy Boxes and Bandwidth Generously Provided by pair Networks
Don't ask to ask, just ask
 
PerlMonks  

Re: Problems with Sys::Syslog and taint

by guice (Scribe)
on May 16, 2000 at 01:42 UTC ( #11755=note: print w/ replies, xml ) Need Help??


in reply to Problems with Sys::Syslog and taint

It's required that you untaint the ENV{PATH} when you run any system command line apps via system, exec ot anything of that nature.
Doing:

local %ENV = (PATH => '/bin');
Works like mdillon pointed out. It's actually better than what I was using which was:
local $ENV{'PATH'} = '/bin';
His code will clear out ENV before it sets that path. Anyhow, localizing ENV and setting the PATH is required for tainted scripts that use system calls. This makes sure you don't have some path in the ENV that you don't know about and can be explioted by others.

-- philip
We put the 'K' in kwality!


Comment on Re: Problems with Sys::Syslog and taint
Select or Download Code
RE: Re: Problems with Sys::Syslog and taint
by mdillon (Priest) on May 16, 2000 at 02:01 UTC
    i decided to completely localize %ENV because taint mode was complaining about my $ENV{BASH_ENV}. i figured it was best to completely redefine the environment to avoid individual errors like this.
      What ever works, what I say :)

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://11755]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others having an uproarious good time at the Monastery: (7)
As of 2014-12-20 21:34 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (99 votes), past polls