http://www.perlmonks.org?node_id=36302


in reply to RE: Warning our Fellow Monks
in thread Warning our Fellow Monks

Taint checking would have fatally crapped out when it discovered that you were attempting to use a piece of a foreign string in a critical operation (opening a file). So yes, it would have been quite sufficient in detecting the problem, but it does nothing to help you fix your script so that it will actually run.

Your best bet is to use tokens in your URL submissions, and then map those tokens to a set of filenames. If that can't be arranged, use a regular expression to "untaint" the data by explicitely declaring permitted characters.

($secure) = ($tainted =~ /(\w+)/); open(F, "< $secure") or die "$!"; # read only "../../bin/ls -l /etc|" -> "bin" (no such file)