Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Re: untainting regex input

by kennethk (Monsignor)
on Aug 23, 2013 at 02:38 UTC ( #1050582=note: print w/ replies, xml ) Need Help??


in reply to untainting regex input

In my own work in this context, I far prefer the use of wildcards to explicit regular expressions; you can handle the specific case of interest, and use quotemeta to clean the rest. It's in line with my web-context philosophy of white listing things rather than blacklisting.

With regards to your actual question, discussion of the feature in question is A bit of magic: executing Perl code in a regular expression. I would say, from a practical standpoint, as long as your parentheses get escaped, you should be safe, since this also blocks some potential denial-of-service via infinite recursion. But given the potential security mess here, I'd be very cautious, especially if this is outward facing. What benefits are you seeking via regex that wildcards are lacking?


#11929 First ask yourself `How would I do this without a computer?' Then have the computer do it the same way.


Comment on Re: untainting regex input

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1050582]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others browsing the Monastery: (13)
As of 2014-09-18 19:47 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    How do you remember the number of days in each month?











    Results (122 votes), past polls