develooper Front page | perl.perl5.porters | Postings from October 2012

Re: No-taint support in Perl

Thread Previous
From:
demerphq
Date:
October 22, 2012 00:47
Subject:
Re: No-taint support in Perl
Message ID:
CANgJU+XEUJhA5no5xhL9yCzgw4jeQG4i0N9d+0oZ9dm8DVqs-A@mail.gmail.com
On Sunday, 21 October 2012, Steffen Mueller wrote:

> On 10/21/2012 05:21 PM, Vincent Pit wrote:
>
>> Hmm, point taken and slightly surprised by the vehemence of your
>>> response. I respectfully disagree, though.
>>>
>>
>> Sometimes I have definite opinions on things, and sometimes I voice
>> them. They may or may not overlap with yours.
>>
>
> Just for the record in case it wasn't clear: There wasn't supposed to be
> even a hint of criticism in those two sentences I wrote.
>
>  I just don't want Perl to support silent code breakage, especially when
>> the only motivation is a slight performance improvement.
>>
>
> Perl supports many, many, many ways to have silent code breakage. But
> admittedly they're generally of different types: Within the language.
>
>  Two compromises that would make sense to me:
>>>
>>> 1) Only support a configure flag for the variant where -t/-T is fatal.
>>> Keep the Perl-internal, undocumented (but obviously named) define so
>>> that whoever wants to use the silent variant doesn't have to maintain
>>> patches against Perl or if anything, only patches that are limited to
>>> very simple and localized changes.
>>>
>>
>> What I objected against was it being *non fatal*, so I'm fine with this
>> as long as it's not documented and not available through Configure. But
>> note that this adds maintenance cost to the core for an undocumented
>> feature, and I thought the trend was to go the other way.
>>
>
> The code difference between the fatal and the silent variants is very
> small. Not a high cost.
>
>  2) Support two variants in Configure: fatal and warning (no silent
>>> variant).
>>>
>>
>> At the time the warning is printed it's already too late, so that's as
>> bad as no warning at all. And I guess that those who want the silent
>> variant will not be satisfied by seeing that warning every time.
>>
>
> It's a warning that would be useful in pre-production, not production. So
> it's not too late. Furthermore, I think there's a class of cases where such
> a warning is fine. It's not silent. If you run a script that actually makes
> real use of -T, you'll know. But it doesn't prevent various test suites of
> CPAN modules from running just because they author figured -T would be a
> good idea in a test's shebang.
>


One thing that worries me is dangerous tests that are expected to be
blocked by tainting being run just fine with the special perl build....

Not that I see it as a show stopper.

Yves


-- 
perl -Mre=debug -e "/just|another|perl|hacker/"

Thread Previous


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About