|Keep It Simple, Stupid|
Untainting safely. (b0iler proofing?)by BrowserUk (Pope)
|on Jun 25, 2002 at 19:39 UTC||Need Help??|
BrowserUk has asked for the wisdom of the Perl Monks concerning the following question:
Yesterday, while casting around looking for 'the right way' (Yes! I know, TMTOWTDI! So less say 'a right way') to do some things, I encountered a link her that led me to read this. Now, without getting into the debate of the merits of the author's style or motivations nor even the specific details of the article, it did serve to highlight several weaknesses in my own treatment of 'external input' and my attempts to 'sanatise' and untaint it.
I've looked around PM looking for a 'standard', tested way of acheiving this (what we might call b0iler proofing with the risk of the collective ire for a bad pun and conferring undue notoriety).
It seems to me that what is needed (I need) is a subroutine, that takes a string and removes all 'unsafe' (meta) characters and character sequences.
My thoughts on writing this are:
I've had a couple of attempt at doing this. I started looping over the string and inspecting each char individually using ord() and comparing against a list of 'known values'.
I then thought of unpack()ing the string to ensure that Perl wouldn't do any magical escaping.
But my Perl skills so far are such that I'm reluctant to trust my own code (and even more reluctant to offer it here for public review again :o), so...
Would you kind people care to share your code to acheive the aims above or point me at code that will acheive those aims?
Offer your input to extending those aims.
Edit by dws to fix tags