Quote:
> > if(!open(FILE, ">online/$username")) ##### offending
> > $username is also picked up from
> > within the script by reading the value from a database.
> > Any solutions to this?
> Have you tried untainting $username in the usual way (see
> perlsec/"Laundering and Detecting Tainted Data")?
> Do you know if the database interface you are claims that it returns
> untainted data? DBI, for example, returns untaineded data by default.
Done - thanks for the tip
I don't know about the database (DB_File in Berkeley Environment) - I haven't
seen anything related to taintedness or not in its documentation. It may be
that I'm able to use it as I specify its name within the perl script. I
notice that I have to untaint, when using open() and readdir(), only the
filenames and not the data contained within.
For example, the following snippet:
<snip>
opendir(ONLINE, "online") or die "Error: cannot open ONLINE
directory</BODY></HTML>";
while ($file=readdir(ONLINE))
{
# filename ($file) is username online, content is unix time of last loading
online.cgi for that user
# refresh of online.cgi is 20 seconds, remove any files older than 30 seconds
# not interested in either . or ..
next if(($file eq '.') || ($file eq '..'));
# untaint $file
$file = &untaint($file);
$filename = $dir . $file;
open(FILE, "$filename") or die "Error: Cannot open
$filename</BODY></HTML>";
flock(FILE, LOCK_SH);
while(<FILE>)
{
chomp;
# $_ = &untaint($_);
$time = $_;
# we just want the first line here - none of the web profile stuff
last;
}
close(FILE);
$time += 30;
Quote:
}
closedir(ONLINE);
sub untaint
{
if($_[0] =~ /^([\s\w]+)$/)
{
return $1;
}
else # $_[0] is tainted
{
print "<BODY BGCOLOR=\"maroon\" TEXT=\"yellow\"
LINK=\"silver\" VLINK=\"silver\">";
print "Error: Tainted data....";
print "</BODY></HTML>";
exit;
}
Quote:
}
<snip>
works fine with the -T switch even though I'm using and not untainting $time
which is the first line of the file. I'm curious why this should be so.
taint problems