develooper Front page | perl.perl5.porters | Postings from October 1999

Re: [BUG] taint seeps

Thread Previous
October 26, 1999 06:39
Re: [BUG] taint seeps
Message ID:
In <>, "M.J.T. Guy" writes:
:Hugo <> wrote
:   [ about the leaking of taintedness ]
:I had always understood this as a feature, because Perl only does
:a very limited data flow analysis.    Specifically, once a tainted
:value has been encountered within an expression, all subsequent values
:generated in the expression are assumed to be tainted.

If that were the case, I would not expect the order of the key/value
pairs to affect the result. 

:Doing anything more complicated would be very expensive  -  presumably
:there'd have to be a separate taint flag for each subexpression or

That may be the problem, but I hope someone will have the tuits to
confirm that this is a deliberate design decision.

:And this _is_ documented, even if obliquely, in perlsec:
:                                               Any variable set
:to a value derived from tainted data will itself be tainted,
:even if it is logically impossible for the tainted data
:to alter the variable.

I think most people would perceive the 'variable' being 'set' here
as $object2->{untainted}, which is not in any way derived from
tainted data. Note that a simple hash assignment does not exhibit
the same problem:

  crypt% perl -Twe '%a = (tainted => $0, untainted => "test"); kill 0, $a{untainted}'
  Argument "test" isn't numeric in kill at -e line 1.

Ah, perhaps you are right: while a hash assignment such as the above
doesn't seep, the same with an arrayref does:

  crypt% perl -Twe '$a = [$0, "test"]->[1]; kill 0, $a'
  Insecure dependency in kill while running with -T switch at -e line 1.

.. so perhaps seeping is specific to lists wrapped into a reference
(though it doesn't appear to infect the keys of hashrefs).

I wish I had time to look into this more deeply though - it sure don't
seem right to me.


Thread Previous Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About