Front page | perl.perl5.porters |
Postings from October 1999
[BUG] taint seeps
From:
Hugo
Date:
October 25, 1999 18:36
Subject:
[BUG] taint seeps
Message ID:
199910260137.CAA10294@crypt.compulink.co.uk
The program below attempts to create an object as a blessed hash, with
both a tainted and an untainted value. It fails on test 4 with all the
installed versions of perl I have here (roughly, 3_97 thru 5_61). Note
that the first two tests pass, implying that the taintedness of one
hash value infects the other only if the tainted one comes first:
somehow the taintedness of the first value is seeping forward to infect
the second.
#!/usr/bin/perl -Twl
sub tainted {
grep {
eval { local $^W = 0; kill 0, $_ };
$@ =~ /^Insecure dependency/
} @_;
}
sub object1 {
my $arg = shift;
bless {
untainted => $arg,
tainted => $0,
};
}
sub object2 {
my $arg = shift;
bless {
tainted => $0,
untainted => $arg,
};
}
print "1..4";
print tainted(object1('test')->{tainted}) ? "ok 1" : "not ok 1";
print !tainted(object1('test')->{untainted}) ? "ok 2" : "not ok 2";
print tainted(object2('test')->{tainted}) ? "ok 3" : "not ok 3";
print !tainted(object2('test')->{untainted}) ? "ok 4" : "not ok 4";
__END__
Hugo
Summary of my perl5 (revision 5.0 version 5 subversion 61) configuration:
Platform:
osname=linux, osvers=2.2.5-16, archname=i686-linux
uname='linux crypt.compulink.co.uk 2.2.5-16 #1 sun may 30 23:00:18 bst 1999 i686 unknown '
config_args='-des -DDEBUGGING -Doptimize=-g -O6 -Dprefix=/opt/perl5.005_61'
hint=recommended, useposix=true, d_sigaction=define
usethreads=undef useperlio=undef d_sfio=undef
use64bits=undef usemultiplicity=undef
Compiler:
cc='cc', optimize='-g -O6', gccversion=egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)
cppflags='-Dbool=char -DHAS_BOOL -DDEBUGGING'
ccflags ='-Dbool=char -DHAS_BOOL -DDEBUGGING'
stdchar='char', d_stdstdio=define, usevfork=false
intsize=4, longsize=4, ptrsize=4, doublesize=8
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
alignbytes=4, usemymalloc=n, prototype=define
Linker and Libraries:
ld='cc', ldflags =' -L/usr/local/lib'
libpth=/usr/local/lib /lib /usr/lib
libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lc -lposix -lcrypt
libc=/lib/libc-2.1.1.so, so=so, useshrplib=false, libperl=libperl.a
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'
Characteristics of this binary (from libperl):
Compile-time options: DEBUGGING
Built under linux
Compiled at Sep 6 1999 14:11:53
@INC:
/opt/perl5.005_61/lib/5.00561/i686-linux
/opt/perl5.005_61/lib/5.00561
/opt/perl5.005_61/lib/site_perl/5.00561/i686-linux
/opt/perl5.005_61/lib/site_perl
.