Phil Pennock <[email protected]> (So 12 Feb 2017 12:30:48 CET): > On 2017-02-12 at 11:30 +0100, Heiko Schlittermann wrote: > > I saw, that '.' now gets pop()ed from @INC in various Perl scripts. > > > > Is there a special reason doing so? If we'd deal with security in mind, > > we should use Perl's taint mode to make the scripts more secure. > > Root invokes these scripts, often for messing with queue analysis. > Invoking them in /tmp is entirely reasonable. Other people can write to > /tmp, so letting people have code be run as root because root invoked an > Exim tool while in /tmp is poor form.
Yes. But '.' is the last in the @INC array.
So, if Perl looks for a module in '.', it already failed finding it in
all the other (system) locations.
If we remove '.' from the @INC array, we should care about other
positions too, not only the last position.
BEGIN {
@INC = grep { !/^[.]$/ } @INC
}
But this prevents a developer from temporarly using '.' in the very
first position of @INC for testing purpose as in
perl -Mlib='.' exigrep
or
PERL5LIB='.' exigrep
But, as it's a developer, one can use
PERL5LIB=$(pwd) exigrep
Conclusion: removing the DOT is appreciated, but, if doing so, it should
be done completly, shouldn't it?
> Taint mode deals with when the invoker's environment is not trusted.
> It's excellent for daemons, CGIs, network protocol clients, etc. It's
> less useful for CLI tools which don't talk to untrusted services. I'm
> not opposed to it I just don't see the point here.
>
> Taint mode doesn't really protect against @INC being stupid.
Taint mode removes any '.' from @INC, and lets Perl ignore
PERL{5,}LIB, and PERL5OPT. While allowing you to put it
back into @INC via
perl -T -I. exigrep
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
gnupg encrypted messages are welcome --------------- key ID: F69376CE -
! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -
signature.asc
Description: Digital signature
-- ## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
