Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic
 
PerlMonks  

Re: Turning on Taint in mod_perl after compile time or in specific packages only?

by Rhandom (Curate)
on Aug 07, 2008 at 21:57 UTC ( #703009=note: print w/replies, xml ) Need Help??


in reply to Turning on Taint in mod_perl after compile time or in specific packages only?

<Superhero> This looks like a job for Taint::Runtime </Superhero>

Update: I should've been more specific. You should use prefork rather than worker. If you use worker, then yes, you will have to deal with a single thread and you can't do much. In a prefork model - every forked interpreter will only deal with one request at a time. The code then to handle this with Taint::Runtime would be:

use Taint::Runtime qw($TAINT taint_env taint_deep); sub my_handler { local $TAINT = 1; taint_env(); taint_deep(\%other_items); ... }


Taint::Runtime documentation goes into detail about why it is a bad idea to do runtime tainting. But just because it is bad in general cases doesn't mean it is bad in thoroughly covered cases. The big danger is making sure data streams that were set up prior to the handler invocation are properly tainted.

my @a=qw(random brilliant braindead); print $a[rand(@a)];
  • Comment on Re: Turning on Taint in mod_perl after compile time or in specific packages only?
  • Download Code

Replies are listed 'Best First'.
Re^2: Turning on Taint in mod_perl after compile time or in specific packages only?
by Bloodnok (Vicar) on Aug 08, 2008 at 10:16 UTC
    ... not sure which I like the most - the answer or your sig :-))

    A user level that continues to overstate my experience :-))

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://703009]
help
Chatterbox?
[stevieb]: I just received full professional license for ALL of JetBrains software due to requesting their opensource request form! I wanted only CLion, but they give them all
[stevieb]: I stated I use IDEA for Perl work, and at work, licensed version of PyCharm
[beech]: is that a good thing?
[stevieb]: absolutely. Free professional IDEs and related software for all the langs I write in, and I wanted CLion because it's a C IDE that can communicate directly with an Arduino

How do I use this? | Other CB clients
Other Users?
Others chilling in the Monastery: (6)
As of 2017-02-20 20:19 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Before electricity was invented, what was the Electric Eel called?






    Results (302 votes). Check out past polls.