What's your favourite method of untainting?

[Corion]

What's tainting?

 102/35%

($foo) = ($val =~ /^(.*)$/g);

 42/14%

($foo) = (keys %{ +{$val}});

 5/2%

($foo) = ($val =~ /^(?!.).$/

 11/4%

A blessed horn of a unicorn untaints everything

 131/45%

291 total votes

[rob_au]

For those who are unaware, the untainting method described in the third option refers specifically to tainting behaviour for hash keys - That is, hash keys are not tainted, ever. From perlsec - Because taintedness is associated with each scalar value, some elements of an array or hash can be tainted and others not. The keys of a hash are never tainted.

[sanPerl]

As per WikiPedia Taint means
in computer science, in particular in the Perl programming language, "tainted" data are considered untrusted and are treated with caution
Some Guru may want to add some more information to it, since it is described in a short manner.

[rinceWind]

A blessed horn of a unicorn untaints everything

Is a 'horn' synonymous with a reference I wonder :). There's potential for a new Acme:: module here.

[mrborisguy]

I'll bite.

Read more... (2 kB)

Note: Untested. And no, I'm not uploading this.

    -Bryan

Update: It seems my untested code did have a flaw! Thanks ambrus++.

[ambrus]

I think this is wrong:

                ($foo) = ($variable =~ /^(.*)$/g);

shouldn't you add an s switch to the regexp so that it would match multi-line strings?

[tbone1]

s/\r\n/\n/g;

[ysth]

Isn't that called deBilling?

[Nkuvu]

Personally like the method: my ($foo) = $var =~ /^.*$/

It's the "I don't care what was there, but now I'm sure it's safe" untaint method. And it looks more impressive than my $foo = 1.
</tongue_in_cheek>

[neosamuri]

A blessed horn of a unicorn untaints everything


This sounds like a NetHack reference. Which brings to mind what can be done with the union of Nethack and perl.

[rdm]

It is. And I'll bite. What specifically did you have in mind?
Log parsing? Gamesaving? Or something More Sinister?
-R

[ysth]

Here's one idea.

[SirBones]

Taint thinner.

[ambrus]

My favourite one is

$string =~ /\A(.*)\z/s or die; $string = $1;

however this one is also nice (for byte strings):

$x = pack "B*", do { unpack "B*", $x };

it appears that if you take a string apart to bits and reassemble, the result is untainted as the individual bits can't be tainted. In contrast, bytes are eight times larger then characters so they're large enough for taint to stick on them, thus the following doesn't untaint the string but returns it unchanged.

$x = pack "C*", do { unpack "C*", $x }; # wrong

[jonadab]

I thought the whole point of running in taint mode in the first place was to remind yourself to sanity-check all the user input and ensure it doesn't have any bizarroid stuff in it that you didn't expect, and that the recommended best practice was to combine untainting with validating, as in

($num) = $num =~ /(\d+)/;
($str) = $str =~ /([A-Za-z0-9_-]+)/;

i.e., everything not specifically allowed is verboten.

[Happy-the-monk]

A blessed horn of a unicorn untaints everything

There's no general way to untaint my vars, as they aren't supposed to contain general values. To make sense, each plausibility check needs to be done individually as to what needs to be checked for, thereby untainting the variable. Simplifying that much doesn't make sense in real life.

Don't blame me for not getting the joke this time =)
I got it, will use the unicorn's horn...

Cheers, Sören

[hardburn]

No, no, no! Only my method gives perfect security:

undef $val;

Let me see you h4x0rs get past that!

[ysth]

$foo = each %{{$foo,0}}

[japhy]

WTF is up with the fourth option? It's got a syntax error, and I can't see how it could possibly work.

[Corion]

Whoops - that's a typo. It should be:

($foo) = ($val =~ /^(?!.).$/);

and the essence of it is, that it never accepts any incoming data (albeit in a roundabout way).

[Anonymous Monk]

I like to just cog it

[kwaping]

What, no -t?

[gu]

What ? You all wise monks don't even have a USB blessed horn of a unicorn ?

Gu

[ambrus]

With the untaint function of the new Taint::Util module.

[TedPride]

I don't untaint with Perl, because I only use it for admin scripts and personal use. My vote goes to blessed horn of a unicorn.