Do I really need to untaint from YAML::Tiny file?

[proggerguy]

Hi Folks,

Does anyone know what's going on here? I will be very thankful for a response!!

Does YAML::Tiny require one to untaint data read from a yaml file?

I recently changed my config file from Config::Tiny to YAML::Tiny

and after doing it I get a taint error message.

>>>> Insecure dependency in open while running with -T switch at testyc.pl ...

I have reduced the problem to test case below showing what's going on with using both config::tiny and yaml::tiny.

Using data from Config::Tiny does not produce an error when opening a file for output but data from YAML::Tiny does.

???

I am running:

This is perl, v5.10.0 built for i486-linux-gnu-thread-multi I have tried this w/ 1.39 and 1.41 of YAML::Tiny.

=====

file: test.configtiny

[dirs]
dir_output_base=./


=====

file: test.yaml

dirs:
  dir_output_base: ./


=====

testyc.pl (run as perl -wT testyc.pl

=====


#!/usr/bin/perl  -wT  
    use strict;
# ======================

    use YAML::Tiny;
    my $yaml = YAML::Tiny->new;
    $yaml = YAML::Tiny->read( 'test.yaml' );
    my $file1="testyc1.txt";
    print "Printing to dir: " . $yaml->[0]->{dirs}->{dir_output_base};
    print "\n";
    print "Printing to file: " . $file1;
    print "\n";

# choose one of the following lines for tainted or untainted

#    my $ut = $yaml->[0]->{dirs}->{dir_output_base};
    my $ut = $1 if ($yaml->[0]->{dirs}->{dir_output_base} =~ /(.*)/); 
+ 
    # the above line untaints anything, just for testing purpose here.
    open (my $outfile1, '>', $ut . $file1);
    print $outfile1 "hello from testyc.pl\n";
    close($outfile1);

# ======================
    use Config::Tiny;
    my $config=Config::Tiny->read('test.configtiny');
    my $file2="testyc2.txt";
    print "Printing to dir: " . $config->{dirs}->{dir_output_base};
    print "\n";
    print "Printing to file: " . $file2;
    print "\n";
    open (my $outfile2, '>', $config->{dirs}->{dir_output_base} . $fil
+e2);
    print $outfile2 "hello from testyc.pl\n";
    close($outfile2);

[CountZero]

If you check the read_string sub in Config::Tiny then you will see that the data are parsed from the config-file through the use of a regex. As a side-effect this untaints the data.

I'm not sure whether to consider this a feature or a bug.

[Anonymous Monk]

Thanks a lot for point me to that line in Config::Tiny.

I was under the impression that a file was trusted. But I was wrong. The follow direct read from a file also produces a taint error.

I guess I will have to try next from a database to check my assumptions on that front.



#!/usr/bin/perl  -wT
open (my $infile, '<', 'testyfin.txt');
my $ofile_name=<$infile>;
my $file3=$ofile_name;
print "\n";
print "Printing to file: " . $file3;
print "\n";
open (my $outfile3, '>', $file3);
print $outfile3 "hello from testyc.pl\n";
close($outfile3);

[spazm]

In both cases you should be manually checking and untainting the data. Taint mode is there for your and your users' protection.

in your example code, you probably want to constrain the allowed paths to place where writing your file won't fubar anything. Or maybe you're happy with users writing files anywhere if privs are elevated. In that case you should make that decision explicit with a fake taint avoidance like in your example code m/(.)/ .

my $.02

[proggerguy]

Thanks for the reply. I appreciate your two cents! I am used to checking everything coming from CGI ...