Re: Why use taint

[theguvnor]

I'm not sure why you are asserting that all parameters must specifically be untainted. I would tend to agree with Juerd that unless you're using it in a system call, it doesn't pose a security problem. (theguvnor would welcome any enlightenment to the contrary).

On the other hand, I don't understand Juerd's assertion that Perl's tainting is such a problem.

1. You don't have to run -T if you don't want.
2. Even when you use it, you only have to untaint those variables that you want to use in system calls.

So I don't know why Juerd is so down on Perl's tainting mechanism...

..Guv

[Juerd]

Next time, reply to the node you're commenting on, please.

I don't use -T, but I think its use is highly overrated. I don't like -T because I trust my own code, find tainting very restricting and don't like the enormous overhead untainting involves.

If there's one thing I hate, it's code like:

($var) = $var =~ /(.*)/s; # untaint $var

# ... or ... (and the following idiom is used a lot more often (why?))

$var = $1 if $var =~ /(.*)/s;

But code like that is seen very, very often. And that's because tainting is often recommended without telling it's not needed when you don't do system calls.

44696420796F7520732F2F2F65206F
7220756E7061636B3F202F6D736720
6D6521203A29202D2D204A75657264

[theguvnor]

I was replying to the node to which I was commenting. I also happened to reference your reply to the same node, in my reply. If I had split my response I would have been --ed for lowering the signal-to-noise ratio, so I guess I'm damned if I do, damned if I don't.

</rant>

I was actually agreeing with you for the most part - tainting is not always required as you point out. But for CGI parameters where the user input does get anywhere near the system, I think it's a useful warning mechanism that there could be unsafe programming.

..Guv

[simon.proctor]

I think in fairness I was neither asserting or insisting someone use taint. Rather I was expressing that it could be used and voicing a personal opinion that it should. If it wasn't clear enough that it was a matter of opinion only then apologies for any confusion caused.