Front page | perl.perl5.porters |
Postings from October 2012
Hi Vincent, On 10/21/2012 01:51 PM, Vincent Pit wrote: >> Both versions have some drawbacks in that the version that makes the use >> of -t/-T fatal will make many a CPAN module's tests fail because use of >> -t/-T is relatively common. The silent version will still make tests >> fail that explicitly test the tainting mechanism and can result in users >> of Perl mistakenly using -t/-T without the expected effect. For these >> reasons, the proposed defines are never to become the default Perl >> configuration but if included in a Perl release, should be documented as >> opt-in, expert-level options. > > Perl should not support disabling -t/-T by making it not fatal, and > adding that kind of option to Configure is already supporting it. People > that want this kind of broken behaviour can hack the core themselves and > get shot in the foot all they want. Hmm, point taken and slightly surprised by the vehemence of your response. I respectfully disagree, though. Taint support doesn't feel part of the language. It's a built-in linter, not a language feature. IMO, patching it out in any way is nowhere near as questionable as, say, removing support for formats. Formats are used much less frequently, yet removing them would change the language in a significant way. Anyway, that's just to explain where I'm coming from. I think that clearly documenting the nature of the switch (expert only, potential security risk if used wrongly, ...) is sufficient due diligence. Two compromises that would make sense to me: 1) Only support a configure flag for the variant where -t/-T is fatal. Keep the Perl-internal, undocumented (but obviously named) define so that whoever wants to use the silent variant doesn't have to maintain patches against Perl or if anything, only patches that are limited to very simple and localized changes. 2) Support two variants in Configure: fatal and warning (no silent variant). Both compromises are perfectly fine with me. Does that make sense? Best regards, SteffenThread Previous | Thread Next