Beefy Boxes and Bandwidth Generously Provided by pair Networks
P is for Practical
 
PerlMonks  

Comment on

( #3333=superdoc: print w/replies, xml ) Need Help??

Nope. Both take just the good, but only one makes that explicit. In this case you assume (correctly or not) that "word" characters are safe. So you either extract the parts containing the word characters and concatenate them back together or you remove anything that's not a word character. Different implementation, same task.

Removing malicious characters would mean deciding that for your intended use the data should not contain a newline, a quote or a null character and doing something like

(my $good = $bad) =~ s/[\r\n'\x00]+//gs;
The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.

Jenda
Enoch was right!
Enjoy the last years of Rome.


In reply to Re^7: Taint mode limitations by Jenda
in thread Taint mode limitations by alain_desilets

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    Corion idly wonders about creating a series of HTTP requests. There seems to be no framework to generate a series of HTTP requests, like "try all these requests"
    [Corion]: This is vaguely inspired by that list of "nasty" strings, which I'd like to replace among HTTP parameters, just to see whether the application crashes, but also for easy downloading of a list of URLs etc
    [Corion]: Maybe I'll just conoct something using Algorithm::Permute to create an (OO) generator for such requests, or a simple function.
    [Corion]: For testing I imagine one would want to test a random sampling of such "bad"/"unexpected" requests, while for downloading, one would want to generate them all in order, but not necessarily as a huge list

    How do I use this? | Other CB clients
    Other Users?
    Others surveying the Monastery: (8)
    As of 2017-01-16 15:40 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?
      Do you watch meteor showers?




      Results (151 votes). Check out past polls.