Beefy Boxes and Bandwidth Generously Provided by pair Networks vroom
more useful options
 
PerlMonks  

Re^6: Taint mode limitations

by Anonymous Monk
on Nov 04, 2012 at 13:08 UTC ( #1002197=note: print w/ replies, xml ) Need Help??


in reply to Re^5: Taint mode limitations
in thread Taint mode limitations

If you think about "removing malicious characters" you do not understand security! You should never remove the bad, you should always take just the good!

It appears you don't understand security either :) Consider

my $good = join '', $bad =~ m/(\w+)/g; my $good = $bad =~ s/\W+//gr;

Sure, only the m// version untaints successfully in perl, but both versions "remove malicious characters" and both versions "take just the good"


Comment on Re^6: Taint mode limitations
Download Code
Re^7: Taint mode limitations
by Jenda (Abbot) on Nov 04, 2012 at 23:39 UTC

    Nope. Both take just the good, but only one makes that explicit. In this case you assume (correctly or not) that "word" characters are safe. So you either extract the parts containing the word characters and concatenate them back together or you remove anything that's not a word character. Different implementation, same task.

    Removing malicious characters would mean deciding that for your intended use the data should not contain a newline, a quote or a null character and doing something like

    (my $good = $bad) =~ s/[\r\n'\x00]+//gs;
    The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.

    Jenda
    Enoch was right!
    Enjoy the last years of Rome.

      The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.

      No, you always decide what are safe characters, and then you remove everything that isn't on that list.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1002197]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others chilling in the Monastery: (9)
As of 2014-04-17 00:12 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    April first is:







    Results (437 votes), past polls