Workaround available for 'Too late for "-T" option' error message??

[martymart]

Hello Monks, I'm running IIS on win2000, using activestate perl, I've written a cgi script, this works fine until I try to add tainting in the first line, then I get the error message

Too late for "-T" option at D:\Local\cgi-bin\helpdesk.cgi line 1.

I'm pretty sure this is because by the time Perl discovers a -T in a script, it's too late to properly taint everything from the environment. So Perl gives up. Works fine when I take the T out of the perl interpreter line. Does anybody know a workaround so that I can add tainting. Thanks in advance.

[thinker]

Hi martymart,

from perldoc perldiag


Too late for "-T" option
           (X) The #! line (or local equivalent) in a Perl script contains the
           -T option, but Perl was not invoked with -T in its command line.
           This is an error because, by the time Perl discovers a -T in a
           script, it's too late to properly taint everything from the envi-
           ronment.  So Perl gives up.

           If the Perl script is being executed as a command using the #!
           mechanism (or its local equivalent), this error can usually be
           fixed by editing the #! line so that the -T option is a part of
           Perl's first argument: e.g. change "perl -n -T" to "perl -T -n".

           If the Perl script is being executed as "perl scriptname", then the
           -T option must appear on the command line: "perl -T scriptname".



Hope this helps

thinker

[Ovid]

What is probably going on is that your Web server configuration uses the Perl ISAPI dll to run your Perl programs. Unless Activestate has changed their mind, you can't use taint checking with ISAPI. This is because the dll is a Perl compiler that remains memory resident. As a result, you don't need to load the Perl executable every time (just the program). However, taint checking must be activated when the Perl compiler loads and cannot be turned on afterwards. Trying to do so it what generates the "Too late for ..." error; it's too late to turn on taint checking.

The only way around this problem with Activestate is to go into IIS and point the program's association away from the dll and towards the Perl executable. This can be a significant performance hit, but you do get the security of taint checking. You'll have to figure out which is more important to you. Frankly, being forced to make this switch is one of the (many) reasons why I don't like working on IIS with Activestate. I realize that you're probably not in a position to switch, but I had to mention it.

Cheers,
Ovid

New address of my CGI Course.
Silence is Evil (feel free to copy and distribute widely - note copyright text)

[monkeygirl]

-T t t t t t o o late folks holds the answer to your problem along with an explanation on why it's happening.

[UnderMine]

Hi, that thread has a good answer when perl is being invoked on a per script basis using perl.exe. I would be interested in knowing if it is possible to do it with with the ISAPI version of perl which is generally prefered by ISPs PerlIS.dll

Alternatives to Taint Checking? talks about this issue but is there a better solution from a performance point of view? Most of these threads are quite old and things have moved on.

Good old ActiveState appear to be as helpful as always can anyone tell me where their search engine is? :(

Just putting my bit in
UnderMine

[monkeygirl]

I've never used Perl with IIS and didn't know that it used PerlIS.dll - sorry for wasting your time :(

But, I did some searching (to make up for it) and found that our dear Ovid replied to an article (warning: offsite) and stated that PerlIS does not support taint checking. As you can see, the reply is dated 01/16/02, which is the most updated information I've been able to find on it (and this is after searching for two hours).

Also, after checking release notes, etc. from ActiveState, they mention nothing about having added support for it.

As for ActiveState's search engine - maybe I'm wrong again, but the only one I've been able to find is the one for the mailing lists.

[perrin]

I think you have to turn it on globally for PerlIS.dll by changing a setting in the Windows registry.