Re^6: Taint mode limitations

in reply to Re^5: Taint mode limitations
in thread Taint mode limitations

If you think about "removing malicious characters" you do not understand security! You should never remove the bad, you should always take just the good!

It appears you don't understand security either :) Consider

my $good = join '', $bad =~ m/(\w+)/g;
my $good = $bad =~ s/\W+//gr;
[download]

Sure, only the m// version untaints successfully in perl, but both versions "remove malicious characters" and both versions "take just the good"

Comment on Re^6: Taint mode limitations Download Code

Replies are listed 'Best First'.
Re^7: Taint mode limitations by Jenda (Abbot) on Nov 04, 2012 at 23:39 UTC
Nope. Both take just the good, but only one makes that explicit. In this case you assume (correctly or not) that "word" characters are safe. So you either extract the parts containing the word characters and concatenate them back together or you remove anything that's not a word character. Different implementation, same task. Removing malicious characters would mean deciding that for your intended use the data should not contain a newline, a quote or a null character and doing something like `(my $good = $bad) =~ s/[\r\n'\x00]+//gs;` [download] The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way. Jenda Enoch was right! Enjoy the last years of Rome.	[reply] [d/l]
Re^8: Taint mode limitations by Anonymous Monk on Nov 05, 2012 at 01:27 UTC
The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way. No, you always decide what are safe characters, and then you remove everything that isn't on that list.	[reply]

In Section Seekers of Perl Wisdom