Beefy Boxes and Bandwidth Generously Provided by pair Networks kudra
"be consistent"
 
PerlMonks  

Why use taint

by simon.proctor (Vicar)
on Mar 09, 2002 at 22:22 UTC ( #150625=note: print w/ replies, xml ) Need Help??


in reply to Re: Re: Errors in my (simple?) CGI Script!
in thread Errors in my (simple?) CGI Script!

Well for a start its coming from the outside world. In my opinion all CGI programs should be able to run under taint mode before they get put onto a live server. All incoming data must be taint checked before being used. In this case we expect a string so we can strip everything that isn't and so remove all the nasty shell characters and \00.

In the context of the program above it might appear overkill but arguably its better to get into good habits early.


Comment on Why use taint
Re: Why use taint
by Juerd (Abbot) on Mar 09, 2002 at 22:36 UTC

    All incoming data must be taint checked before being used.

    I disagree.

    Only data that is used in external calls must be taint checked. For example, when a name is put in a cookie, just for fun, there's absolutely no reason to taint check it (you should think about encoding it, though).

    I dislike Perl's tainting, because it lets _all_ external input be tainted (and that decreases performance), while some things are never used in a dangerous environment. While it might be a good idea for beginners to always taint everything, I personally HATE -T, and would rather be able to have a lexical taint pragma, and taint and untaint functions for those moments where you want to have a check on some data, or when you know some data is completely safe.

    44696420796F7520732F2F2F65206F
    7220756E7061636B3F202F6D736720
    6D6521203A29202D2D204A75657264
    

      While not as absolute as a taint pragma, the Taint module offers the ability to introduce taint checkpoints in your code. For example:

      use Taint; warn "Oops" if tainted $num, @ids; kill $num, @ids;

      While not as encompassing as a taint pragma, these checkpoints, if placed correctly can tighten up your code without invoking the entire script with the -T. The use of this module however does require some forethought and understanding of tainted data and identification of vunerable execution points within your code.

       

      perl -e 's&&rob@cowsnet.com.au&&&split/[@.]/&&s&.com.&_&&&print'

      Only data that is used in external calls must be taint checked. For example, when a name is put in a cookie, just for fun, there's absolutely no reason to taint check it
      Absolutely no reason to taint check? What if the name they give you contains "\r\n"? If you blindly copied that name into a Set-Cookie header, someone could insert arbitrary HTTP headers and HTML content into your output with a cross-site scripting attack.
      you should think about encoding it, though
      Encoding will solve this problem in most cases. CGI.pm automatically url-escapes cookie contents, which is yet another reason to always use it.

        As you said, encoding solves the problem. And I don't like CGI.pm, and won't use it unless forced. Not even for cookies, I'd use CGI::Cookie for that, if I have to (note: CGI::Cookies is used by CGI.pm). Or I'd just write a quick-and-dirty regex like s/(\W)/sprintf "%%%02x", ord $1/ge.

        44696420796F7520732F2F2F65206F
        7220756E7061636B3F202F6D736720
        6D6521203A29202D2D204A75657264
        

Re: Why use taint
by theguvnor (Chaplain) on Mar 10, 2002 at 01:19 UTC

    I'm not sure why you are asserting that all parameters must specifically be untainted. I would tend to agree with Juerd that unless you're using it in a system call, it doesn't pose a security problem. (theguvnor would welcome any enlightenment to the contrary).

    On the other hand, I don't understand Juerd's assertion that Perl's tainting is such a problem.

    1. You don't have to run -T if you don't want.
    2. Even when you use it, you only have to untaint those variables that you want to use in system calls.

    So I don't know why Juerd is so down on Perl's tainting mechanism...

    ..Guv

      Next time, reply to the node you're commenting on, please.

      I don't use -T, but I think its use is highly overrated. I don't like -T because I trust my own code, find tainting very restricting and don't like the enormous overhead untainting involves.

      If there's one thing I hate, it's code like:

      ($var) = $var =~ /(.*)/s; # untaint $var # ... or ... (and the following idiom is used a lot more often (why?)) $var = $1 if $var =~ /(.*)/s;
      But code like that is seen very, very often. And that's because tainting is often recommended without telling it's not needed when you don't do system calls.

      44696420796F7520732F2F2F65206F
      7220756E7061636B3F202F6D736720
      6D6521203A29202D2D204A75657264
      

        I was replying to the node to which I was commenting. I also happened to reference your reply to the same node, in my reply. If I had split my response I would have been --ed for lowering the signal-to-noise ratio, so I guess I'm damned if I do, damned if I don't.

        </rant>

        I was actually agreeing with you for the most part - tainting is not always required as you point out. But for CGI parameters where the user input does get anywhere near the system, I think it's a useful warning mechanism that there could be unsafe programming.

        ..Guv

      I think in fairness I was neither asserting or insisting someone use taint. Rather I was expressing that it could be used and voicing a personal opinion that it should. If it wasn't clear enough that it was a matter of opinion only then apologies for any confusion caused.

Re: Why use taint
by shotgunefx (Parson) on Mar 10, 2002 at 01:44 UTC
    Personally I don't use taint. Whenever I do anything that could touch the outside I treat it like a bomb. (With great care.) But for someone less familiar with the dangers, It can't hurt. Though it might not help either unless they understand why they are doing and what is dangerous.

    -Lee

    "To be civilized is to deny one's nature."

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://150625]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (4)
As of 2014-04-19 23:45 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    April first is:







    Results (485 votes), past polls