Beefy Boxes and Bandwidth Generously Provided by pair Networks
The stupid question is the question not asked
 
PerlMonks  

Re: Re: First Time Untainting Data

by svsingh (Priest)
on Oct 10, 2003 at 17:05 UTC ( #298322=note: print w/ replies, xml ) Need Help??


in reply to Re: First Time Untainting Data
in thread First Time Untainting Data

Thanks for the tip. I rewrote the untaint subroutine as follows (borrowing from perlsec):

sub untaint { my $s = $_[0]; if ($s =~ /^([\w \-\@\(\)\,\.\/]+)$/) { $s = $1; # $data now untainted } else { die "Bad data in $s"; # log this somewhere } return $s; }

When I get home, I'll look into writing a separate untaint subroutine for each field, but is this more correct than the original?

Thanks again.


Comment on Re: Re: First Time Untainting Data
Download Code
Replies are listed 'Best First'.
Re: First Time Untainting Data
by Abigail-II (Bishop) on Oct 10, 2003 at 17:10 UTC
    This is at least a syntactical valid way of untainting the data, but I do not know whether it's semantically correct. That depends on how the data is used. And do yourself (and all readers of your code), don't backwack everything. Only use a backslash when it's really needed. Like this:
    if ($s =~ m{^([-\w \@(),./]+)$}) {

    Abigail

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://298322]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (12)
As of 2015-07-30 15:53 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    The top three priorities of my open tasks are (in descending order of likelihood to be worked on) ...









    Results (273 votes), past polls