Re: Opening a pipe when taint mode is enabled

2009-01-13 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: >> >> How would I allow for spaces but not newlines > > By including a space in the regex, just as Mike showed you in another > reply. > http://www.nntp.perl.org/group/perl.beginners.cgi/2009/01/msg13364.html > Oh my USENET client didn't have the space in his reply.

Re: Opening a pipe when taint mode is enabled

2009-01-12 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: Gunnar Hjalmarsson wrote: Adam Jimerson wrote: Yea I looked it up and all I needed to do was add \s for whitespaces, Which would also allow for newlines. That sounds dangerous to me, and is an example why it's not a good idea to write your own code, that allows the worl

Re: Opening a pipe when taint mode is enabled

2009-01-12 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: > Adam Jimerson wrote: >> On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: >>> Adam Jimerson wrote: It seams I over looked the space, is it possible to include spaces in the search string? >>> >>> Of course it is. What you call search string is

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: Adam Jimerson wrote: It seams I over looked the space, is it possible to include spaces in the search string? Of course it is. What you call search string is a regular expression. Obviously you have some r

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Adam Jimerson
On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: > Adam Jimerson wrote: > > Gunnar Hjalmarsson wrote: > >> You don't say what to do if the untainting fails. This code: > > >> if ($name =~ /^([...@\w.]+)$/) { > >> $name = $1; > >> }; > > >> should better be: > > >> if ($name =~ /^([

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: Gunnar Hjalmarsson wrote: You don't say what to do if the untainting fails. This code: if ($name =~ /^([...@\w.]+)$/) { $name = $1; }; should better be: if ($name =~ /^([...@\w.]+)$/) { $name = $1; } else { die "Untainting of the name failed"; } Please consider, for inst

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: > Adam Jimerson wrote: >> I attached my code for my program, > > You don't say what to do if the untainting fails. This code: > > if ($name =~ /^([...@\w.]+)$/) { > $name = $1; > }; > > should better be: > > if ($name =~ /^([...@\w.]+)$/) { > $name = $1; > } else { >

Re: Opening a pipe when taint mode is enabled (was: Send email using SMTP)

2009-01-10 Thread Mike Williams
On Fri, Jan 9, 2009 at 6:30 PM, Adam Jimerson wrote: > Gunnar Hjalmarsson wrote: > > > Adam Jimerson wrote: > >> > >> According to perlsec I need to use it as a key in a hash or reference a > >> substring. The example given is > >> > >> ,[ ] > >> if ($data =~ /^([...@\w.]+)$/) { > >> $data

Re: Opening a pipe when taint mode is enabled

2009-01-10 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: I attached my code for my program, You don't say what to do if the untainting fails. This code: if ($name =~ /^([...@\w.]+)$/) { $name = $1; }; should better be: if ($name =~ /^([...@\w.]+)$/) { $name = $1;

Re: Opening a pipe when taint mode is enabled (was: Send email using SMTP)

2009-01-10 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: > Adam Jimerson wrote: >> >> According to perlsec I need to use it as a key in a hash or reference a >> substring. The example given is >> >> ,[ ] >> if ($data =~ /^([...@\w.]+)$/) { >> $data = $1; # $data now untainted >> } else { >> die "Bad data in '$data'";