It's required that you untaint the ENV{PATH} when you run any system command line apps via system, exec ot anything of that nature.
Doing:
local %ENV = (PATH => '/bin');
Works like mdillon pointed out. It's actually better than what I was using which was:
local $ENV{'PATH'} = '/bin';
His code will clear out ENV before it sets that path. Anyhow, localizing ENV and setting the PATH is required for tainted scripts that use system calls. This makes sure you don't have some path in the ENV that you don't know about and can be explioted by others.
-- philip
We put the 'K' in kwality!
-
Are you posting in the right place? Check out Where do I post X? to know for sure.
-
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big>
<blockquote> <br /> <dd>
<dl> <dt> <em> <font>
<h1> <h2> <h3> <h4>
<h5> <h6> <hr /> <i>
<li> <nbsp> <ol> <p>
<small> <strike> <strong>
<sub> <sup> <table>
<td> <th> <tr> <tt>
<u> <ul>
-
Snippets of code should be wrapped in
<code> tags not
<pre> tags. In fact, <pre>
tags should generally be avoided. If they must
be used, extreme care should be
taken to ensure that their contents do not
have long lines (<70 chars), in order to prevent
horizontal scrolling (and possible janitor
intervention).
-
Want more info? How to link
or How to display code and escape characters
are good places to start.
|
