http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5645
Summary: Transition to explicit untainting in modules
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Platform: Other
OS/Version: All
Status: NEW
Severity: normal
Priority: P5
Component: Libraries
AssignedTo: [email protected]
ReportedBy: [EMAIL PROTECTED]
The implicit untainting mechanism offered by Perl in a form
of regexp matching has its good and its undesired sides.
The good side is that in some cases it does the right thing
when a programmer is careful to use it carefully.
The down side is that regexp matching is also used for other
purposes, and the untainting action is more often than not
unintentional, leading to data laundering as a side effect,
defeating the taint checking safety net.
The SA module Util already provides routines for explicit
untainting of variables, but so far the untaint_var() has
only rarely been used. On the other front, Perl provides
a pragma (already in 5.6.1, possibly earlier):
use re 'taint';
which allows turning off the implicit untainting.
Combining both offers us best of both worlds, allowing
a programmer to explicitly untaint data when required,
and avoid implicit untainting when just thinking of
program's functionality.
My current round of commits to trunk is providing this
transition. First some preparatory grounds has been laid down,
and the final stroke is placing a "use re 'taint'" in all
modules. Taking out the last step reverts to the traditional
behaviour, if a serious need arises.
I'll follow up with more comment, bear with me for few hours
(although all transitional steps keep code normally functional),
then you may shoot :)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
