develooper Front page | perl.perl5.porters | Postings from October 2012

Re: No-taint support in Perl

Thread Previous | Thread Next
From:
Jan Dubois
Date:
October 22, 2012 11:22
Subject:
Re: No-taint support in Perl
Message ID:
CAD-TLz_QEGbYXTeqH00ahskGxdTsvJ73n+S2qdD8AHvXyJCa_Q@mail.gmail.com
On Mon, Oct 22, 2012 at 11:15 AM, David Golden <xdg@xdg.me> wrote:
> Meant for list?

Yes.

> On Mon, Oct 22, 2012 at 2:10 PM, Jan Dubois <jand@activestate.com> wrote:
>> To me the only "issue" is that the person running perl might not be
>> the one who built and installed a perl without taint support.
>
> /me shrugs.  That's a "blame the sysadmin" situation as far as I'm
> concerned.  What if the sysadmin compiled out threads?  Or PerlIO? Or
> some equally bizarro thing? Or just compiled 32 bit on a 64 bit
> machine?

All the other configuration changes have some visible breakage.
Missing taint support however is simply a missing safety net that you
assume is there, but don't expect to use. But when you need it, it is
too late to discover that it was missing.

>> How about adding an environment variable that tells the taint-less
>> perl that it is ok to ignore -t/-T?
>
> That's a great compromise, since it would only have effect when
> command line options are processed.  Easy to set for module
> installation and leave *unset* for day-to-day operation, if so
> desired.

Cheers,
-Jan

Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About