Re: Opening a pipe when taint mode is enabled

2009-01-13 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: How would I allow for spaces but not newlines By including a space in the regex, just as Mike showed you in another reply. http://www.nntp.perl.org/group/perl.beginners.cgi/2009/01/msg13364.html Oh my USENET client didn't have the space in his reply. This is

Re: Opening a pipe when taint mode is enabled

2009-01-12 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: Adam Jimerson wrote: On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: Adam Jimerson wrote: It seams I over looked the space, is it possible to include spaces in the search string? Of course it is. What you call search string is a regular

Re: Opening a pipe when taint mode is enabled

2009-01-12 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: Gunnar Hjalmarsson wrote: Adam Jimerson wrote: Yea I looked it up and all I needed to do was add \s for whitespaces, Which would also allow for newlines. That sounds dangerous to me, and is an example why it's not a good idea to write your own code, that allows the

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: Gunnar Hjalmarsson wrote: You don't say what to do if the untainting fails. This code: if ($name =~ /^([...@\w.]+)$/) { $name = $1; }; should better be: if ($name =~ /^([...@\w.]+)$/) { $name = $1; } else { die Untainting of the name failed; } Please consider, for

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Adam Jimerson
On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: Adam Jimerson wrote: Gunnar Hjalmarsson wrote: You don't say what to do if the untainting fails. This code: if ($name =~ /^([...@\w.]+)$/) { $name = $1; }; should better be: if ($name =~ /^([...@\w.]+)$/) { $name

Re: Opening a pipe when taint mode is enabled

2009-01-11 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: On Jan 11, 8:21 am, nore...@gunnar.cc (Gunnar Hjalmarsson) wrote: Adam Jimerson wrote: It seams I over looked the space, is it possible to include spaces in the search string? Of course it is. What you call search string is a regular expression. Obviously you have some

Re: Opening a pipe when taint mode is enabled (was: Send email using SMTP)

2009-01-10 Thread Adam Jimerson
Gunnar Hjalmarsson wrote: Adam Jimerson wrote: According to perlsec I need to use it as a key in a hash or reference a substring. The example given is ,[ ] if ($data =~ /^([...@\w.]+)$/) { $data = $1; # $data now untainted } else { die Bad data in '$data'; # log this

Re: Opening a pipe when taint mode is enabled

2009-01-10 Thread Gunnar Hjalmarsson
Adam Jimerson wrote: I attached my code for my program, You don't say what to do if the untainting fails. This code: if ($name =~ /^([...@\w.]+)$/) { $name = $1; }; should better be: if ($name =~ /^([...@\w.]+)$/) { $name = $1;

Re: Opening a pipe when taint mode is enabled (was: Send email using SMTP)

2009-01-10 Thread Mike Williams
On Fri, Jan 9, 2009 at 6:30 PM, Adam Jimerson vend...@charter.net wrote: Gunnar Hjalmarsson wrote: Adam Jimerson wrote: According to perlsec I need to use it as a key in a hash or reference a substring. The example given is ,[ ] if ($data =~ /^([...@\w.]+)$/) { $data =