Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic
 
PerlMonks  

Re^7: Taint mode limitations

by Jenda (Abbot)
on Nov 04, 2012 at 23:39 UTC ( #1002251=note: print w/ replies, xml ) Need Help??


in reply to Re^6: Taint mode limitations
in thread Taint mode limitations

Nope. Both take just the good, but only one makes that explicit. In this case you assume (correctly or not) that "word" characters are safe. So you either extract the parts containing the word characters and concatenate them back together or you remove anything that's not a word character. Different implementation, same task.

Removing malicious characters would mean deciding that for your intended use the data should not contain a newline, a quote or a null character and doing something like

(my $good = $bad) =~ s/[\r\n'\x00]+//gs;
The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.

Jenda
Enoch was right!
Enjoy the last years of Rome.


Comment on Re^7: Taint mode limitations
Download Code
Re^8: Taint mode limitations
by Anonymous Monk on Nov 05, 2012 at 01:27 UTC

    The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.

    No, you always decide what are safe characters, and then you remove everything that isn't on that list.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1002251]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others surveying the Monastery: (14)
As of 2014-07-22 09:37 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My favorite superfluous repetitious redundant duplicative phrase is:









    Results (109 votes), past polls