Beefy Boxes and Bandwidth Generously Provided by pair Networks
Come for the quick hacks, stay for the epiphanies.
 
PerlMonks  

Re^3: The importance of avoiding the shell

by petdance (Parson)
on Oct 01, 2014 at 19:50 UTC ( [id://1102581]=note: print w/replies, xml ) Need Help??


in reply to Re^2: The importance of avoiding the shell
in thread The importance of avoiding the shell

No, I am not making any claims about taint mode mitigating the bash bug.

My point is that the bash bug is, at its core, about treating untrusted data as executable code. Perl's taint mode is designed to catch that problem in Perl code.

Say you get an argument from the command line in your Perl program. That variable is now tainted, because it came from an untrusted source. Now, say you try to execute a command with system using that variable. Perl's taint mode will disallow it because the data fed to system is untrustworthy.

xoxo,
Andy

  • Comment on Re^3: The importance of avoiding the shell

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://1102581]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others having an uproarious good time at the Monastery: (3)
As of 2024-04-20 01:11 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found