diff options
| author | Joey Hess <joey@kodama.kitenet.net> | 2008-01-05 02:07:29 -0500 |
|---|---|---|
| committer | Joey Hess <joey@kodama.kitenet.net> | 2008-01-05 02:07:29 -0500 |
| commit | 9589b7a83c943891dfbaaea38781b2cb4366cc4f (patch) | |
| tree | 778102f379ec55ccedaf9ae49b4160fbee710a2b /doc/bugs/taint_issue_with_regular_expressions.mdwn | |
| parent | b81eabe8a61bd3ac1302b844311dadc57d25131b (diff) | |
| download | ikiwiki-9589b7a83c943891dfbaaea38781b2cb4366cc4f.tar ikiwiki-9589b7a83c943891dfbaaea38781b2cb4366cc4f.tar.gz | |
response, improve NOTAINT docs
Diffstat (limited to 'doc/bugs/taint_issue_with_regular_expressions.mdwn')
| -rw-r--r-- | doc/bugs/taint_issue_with_regular_expressions.mdwn | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/doc/bugs/taint_issue_with_regular_expressions.mdwn b/doc/bugs/taint_issue_with_regular_expressions.mdwn index 174b4f1c5..e05a59879 100644 --- a/doc/bugs/taint_issue_with_regular_expressions.mdwn +++ b/doc/bugs/taint_issue_with_regular_expressions.mdwn @@ -7,3 +7,16 @@ It works if I replace it with: my ($f)=/(^[-[:alnum:]_.:\/+]+$)/; # untaint which is exactly the same regular expression drawn out as a constant. It appears that %config gets some tainted data and is itself being marked entirely tainted, which may prevent using regular expressions contained in it for untainting other data. I'm using Perl 5.8.8. + +> How could `%config` possible get tainted? That would be a major security +> hole. It seems more likely that perl containes to have taint flag bugs +> even in 5.8. See also: [[prune_causing_taint_mode_failures]], +> [[Insecure_dependency_in_mkdir]], +> [[Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn]], +> and especially [[debbug 411786]] +> +> The last of those was the last straw for me, and I disabled taint +> checking in the debian package. You can do the same by building ikiwiki +> with NOTAINT=1. :-( --[[Joey]] + +[[tag done]] |