Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

Re: Alternatives to Taint Checking?

by rob_au (Abbot)
on May 24, 2001 at 06:22 UTC ( #82792=note: print w/ replies, xml ) Need Help??


in reply to Alternatives to Taint Checking?

An alternative which I have used before in packages that I have written that demanded taint checking for security reasons, was to use the Taint module - I used this, in combination with some code to 'unscrub' the passed parameters (as suggested by Tye) to vet parameters passed to the package module I wrote before passing the details into a banking gateway package.

While this method doesn't give you the flexibility of having the perl interpreter die if tainted data is passed into an insecure statement, it does allow you to easily build 'taint checks' into your data in the same way - Yes, these checks could easily be done through weird alternatives for each section of code. This method with Taint.pm however, I feel is a better option, although I must admit it does take some forethought on the part of the programmer to identify insecure points of execution.


Comment on Re: Alternatives to Taint Checking?

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://82792]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others scrutinizing the Monastery: (5)
As of 2014-11-29 03:47 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My preferred Perl binaries come from:














    Results (203 votes), past polls