Re: CGI->params() should be tainted, right?

Joe Schaefer wrote: > > "Kevin Spencer" <[EMAIL PROTECTED]> writes: > > [...] > >> Using the URL: >> >> http://myserverhere/cgi-bin/taint-test/taint.pl?log=foo >> >> Produces: >> >> Oops! Where's the taint?!? >> >> $^TAINT=1 > > CGI.pm uses $r->args to get at the query string, > which isn't m

Re: CGI->params() should be tainted, right?

Scott Gifford wrote: > > > FYI, this test case works properly under my installation of Debian > mod_perl 1.29.0.2 under apache 1.3.34. > > Jalex, you might want to print out the value of your test variable and > make sure it is being received properly. I thought I s

Re: CGI->params() should be tainted, right?

Michael Peters wrote: > > jalex wrote: >> I'm running mod_perl 2.0.2 under apache 2.0.54. After adding >> "PerlSwitches >> -wT" to my apache config, I wanted to test that I had taint mode was >> indeed >> working, so I wrote a test script that

CGI->params() should be tainted, right?

I'm running mod_perl 2.0.2 under apache 2.0.54. After adding "PerlSwitches -wT" to my apache config, I wanted to test that I had taint mode was indeed working, so I wrote a test script that purposely misused a CGI parameter, expecting the taint exception to be thrown. I was surprised to find it wa