Re: What's your favourite method of untainting?

[ambrus]

My favourite one is

$string =~ /\A(.*)\z/s or die; $string = $1;

however this one is also nice (for byte strings):

$x = pack "B*", do { unpack "B*", $x };

it appears that if you take a string apart to bits and reassemble, the result is untainted as the individual bits can't be tainted. In contrast, bytes are eight times larger then characters so they're large enough for taint to stick on them, thus the following doesn't untaint the string but returns it unchanged.

$x = pack "C*", do { unpack "C*", $x }; # wrong