develooper Front page | perl.perl5.porters | Postings from October 1999

[BUG] taint seeps

From:
Hugo
Date:
October 25, 1999 18:36
Subject:
[BUG] taint seeps
Message ID:
199910260137.CAA10294@crypt.compulink.co.uk
The program below attempts to create an object as a blessed hash, with
both a tainted and an untainted value. It fails on test 4 with all the
installed versions of perl I have here (roughly, 3_97 thru 5_61). Note
that the first two tests pass, implying that the taintedness of one
hash value infects the other only if the tainted one comes first:
somehow the taintedness of the first value is seeping forward to infect
the second.

#!/usr/bin/perl -Twl
sub tainted {
  grep {
    eval { local $^W = 0; kill 0, $_ };
    $@ =~ /^Insecure dependency/
  } @_;
}
sub object1 {
  my $arg = shift;
  bless {
    untainted => $arg,
    tainted => $0,
  };
}
sub object2 {
  my $arg = shift;
  bless {
    tainted => $0,
    untainted => $arg,
  };
}
print "1..4";
print tainted(object1('test')->{tainted}) ? "ok 1" : "not ok 1";
print !tainted(object1('test')->{untainted}) ? "ok 2" : "not ok 2";
print tainted(object2('test')->{tainted}) ? "ok 3" : "not ok 3";
print !tainted(object2('test')->{untainted}) ? "ok 4" : "not ok 4";
__END__

Hugo
Summary of my perl5 (revision 5.0 version 5 subversion 61) configuration:
  Platform:
    osname=linux, osvers=2.2.5-16, archname=i686-linux
    uname='linux crypt.compulink.co.uk 2.2.5-16 #1 sun may 30 23:00:18 bst 1999 i686 unknown '
    config_args='-des -DDEBUGGING -Doptimize=-g -O6 -Dprefix=/opt/perl5.005_61'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef useperlio=undef d_sfio=undef
    use64bits=undef usemultiplicity=undef
  Compiler:
    cc='cc', optimize='-g -O6', gccversion=egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)
    cppflags='-Dbool=char -DHAS_BOOL -DDEBUGGING'
    ccflags ='-Dbool=char -DHAS_BOOL -DDEBUGGING'
    stdchar='char', d_stdstdio=define, usevfork=false
    intsize=4, longsize=4, ptrsize=4, doublesize=8
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    alignbytes=4, usemymalloc=n, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lc -lposix -lcrypt
    libc=/lib/libc-2.1.1.so, so=so, useshrplib=false, libperl=libperl.a
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'


Characteristics of this binary (from libperl): 
  Compile-time options: DEBUGGING
  Built under linux
  Compiled at Sep  6 1999 14:11:53
  @INC:
    /opt/perl5.005_61/lib/5.00561/i686-linux
    /opt/perl5.005_61/lib/5.00561
    /opt/perl5.005_61/lib/site_perl/5.00561/i686-linux
    /opt/perl5.005_61/lib/site_perl
    .



nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About