Ask Bjørn Hansen wrote:
A couple of generic detaint regular expressions sounds reasonable
though, no? Or maybe it's just an endless downhill slope (and not in a
good way). Hmn.
I was thinking about that after I sent my last response. If we offered
a trio of detainting methods for:
1) numbers (with optional decimal);
2) path (should we use a module to check for relative ../../ paths?);
3) text (match anything in Latin-1 ;-)
then we would cover the ground pretty thoroughly. The question we
should ask is whether we need to worry about the paths parameter, but
since we are basically limiting ourselves to checking config files on
disk, we have to assume that anyone with access to those could do far
more harm than messing with a SMTP service... ;-)
John
