Re: taint, safe, mkpath trouble

[Wiggins d'Anconia]

Since no one else responded I thought I would make a guess. Have you looked into "untainting" %ENV by removing the 4 values indicated in the perldoc perlsec , perldoc perlrun docs? If all of ENV is tainted at once rather than by key (which I don't know) then that could be the root of the problem. I would also guess that it isn't a problem with 'mkpath'->'mkdir' but with the ENV{'DOCUMENT_ROOT'} that you are using in the path. As the $ENV{'DOCUMENT_ROOT'} assuming it is tainted would taint any variables set in File/Path.pm which it appears to use in its 'mkdir' call.

HTH,

http://danconia.org

Patricia Hinman wrote:

I'm trying to use taint, strict and Safe in all my
files. I'm new to the Safe module and unsure about
this code.


#!C:\Perl\bin\perl.exe -w -T #!/usr/bin/perl -w -T use strict;

if($q->param("add_a_dir")){
my$newdir = $q->param("add_a_dir");
$newdir =~ s/[^\w\-\.]//g;
$dirext .= $newdir;
push(@message, "found param add_a_dir");

#my$mkpathsafe = new Safe();

#this doesn't go inside the sub add_a_dir
#$mkpathsafe->share('&add_a_dir');

#this goes inside add_a_dir but throws a taint error
&add_a_dir;

sub add_a_dir{
push(@message, "in param add_a_dir");
unless(-e "$ENV{'DOCUMENT_ROOT'}/$htmldir/$dirext"){
eval {mkpath("$ENV{'DOCUMENT_ROOT'}/$htmldir/$dirext",
0,0755)};
if ($@) {
push(@message,"Couldn't Make Directory:\n
$ENV{'DOCUMENT_ROOT'}/$htmldir/$dirext, $@");
}else{push(@message,"Made Directory:\n
$ENV{'DOCUMENT_ROOT'}/$htmldir/$dirext")}
}
}
}

Error:
Couldn't Make Directory:
C:/Apache2/htdocs/hayfork/group, Insecure dependency
in mkdir while running with -T switch at
C:/Perl/lib/File/Path.pm line 147, <DIRINFO> line 2.

Can someone tell me how to use mkpath with taint and
Safe?

Thankyou so much for your time.

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com

--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]