You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@perl.apache.org by "Philippe M . Chiasson" <go...@cpan.org> on 2001/09/08 10:08:18 UTC
[Patch] Apache::TestConfigParse and Taint mode
Small patch to supress an annoying taint warning
And btw, this isn't safe at all, isn't it? It's just bypassing the
taint checking... Should it be fixed or what?
--
Philippe M. Chiasson <go...@cpan.org>
Extropia's Resident System Guru
http://www.eXtropia.com/
When you rewrite a compiler from scratch, you sometimes fix
things you didn't know were broken.
-- Larry Wall
perl -e '$$=\${gozer};{$_=unpack(P26,pack(L,$$));/^Just Another Perl Hacker!\n$/&&print||$$++&&redo}'
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by "Philippe M . Chiasson" <go...@cpan.org>.
On Sat, Sep 08, 2001 at 05:43:15PM +0800, Stas Bekman wrote:
> On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
>
> > On Sat, Sep 08, 2001 at 05:15:19PM +0800, Stas Bekman wrote:
> > > On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
> > >
> > > > Small patch to supress an annoying taint warning
> > >
> > > Philippe, please inline the patches, so we could comment on these.
> >
> > Sure thing Stas. Will do that next time. Or do you prefer me to resend them all?
>
> No, no, that's fine.
>
> > > > And btw, this isn't safe at all, isn't it? It's just bypassing the
> > > > taint checking... Should it be fixed or what?
> > >
> > > According to perlsec manpage this is what should be done:
> > >
> > > $ENV{'PATH'} = '/bin:/usr/bin';
> > > delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
> > >
> > > hence in this particular case the patch should be:
> > >
> > > local %ENV;
> > > delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
> >
> > Simple curiosity : What about non-unixes OSes?
>
> I don't know. Just following the insructions from perlsec manpage. I guess
> that's what makes the open "|" untainted, so we make it happy. In any case
> this is supposed to be safe code, since it's just a build system. If the
> user doesn't trust the code, he has to read it all. I cannot see how this
> thing can be exploited.
Agreed ;-) Just asking...
> _____________________________________________________________________
> Stas Bekman JAm_pH -- Just Another mod_perl Hacker
> http://stason.org/ mod_perl Guide http://perl.apache.org/guide
> mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
> http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
>
>
--
Philippe M. Chiasson <go...@cpan.org>
Extropia's Resident System Guru
http://www.eXtropia.com/
When you rewrite a compiler from scratch, you sometimes fix
things you didn't know were broken.
-- Larry Wall
perl -e '$$=\${gozer};{$_=unpack(P26,pack(L,$$));/^Just Another Perl Hacker!\n$/&&print||$$++&&redo}'
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by Stas Bekman <st...@stason.org>.
On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
> On Sat, Sep 08, 2001 at 05:15:19PM +0800, Stas Bekman wrote:
> > On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
> >
> > > Small patch to supress an annoying taint warning
> >
> > Philippe, please inline the patches, so we could comment on these.
>
> Sure thing Stas. Will do that next time. Or do you prefer me to resend them all?
No, no, that's fine.
> > > And btw, this isn't safe at all, isn't it? It's just bypassing the
> > > taint checking... Should it be fixed or what?
> >
> > According to perlsec manpage this is what should be done:
> >
> > $ENV{'PATH'} = '/bin:/usr/bin';
> > delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
> >
> > hence in this particular case the patch should be:
> >
> > local %ENV;
> > delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
>
> Simple curiosity : What about non-unixes OSes?
I don't know. Just following the insructions from perlsec manpage. I guess
that's what makes the open "|" untainted, so we make it happy. In any case
this is supposed to be safe code, since it's just a build system. If the
user doesn't trust the code, he has to read it all. I cannot see how this
thing can be exploited.
_____________________________________________________________________
Stas Bekman JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by "Philippe M . Chiasson" <go...@cpan.org>.
On Sat, Sep 08, 2001 at 05:15:19PM +0800, Stas Bekman wrote:
> On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
>
> > Small patch to supress an annoying taint warning
>
> Philippe, please inline the patches, so we could comment on these.
Sure thing Stas. Will do that next time. Or do you prefer me to resend them all?
> > And btw, this isn't safe at all, isn't it? It's just bypassing the
> > taint checking... Should it be fixed or what?
>
> According to perlsec manpage this is what should be done:
>
> $ENV{'PATH'} = '/bin:/usr/bin';
> delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
>
> hence in this particular case the patch should be:
>
> local %ENV;
> delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
Simple curiosity : What about non-unixes OSes?
> _____________________________________________________________________
> Stas Bekman JAm_pH -- Just Another mod_perl Hacker
> http://stason.org/ mod_perl Guide http://perl.apache.org/guide
> mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
> http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
>
>
--
Philippe M. Chiasson <go...@cpan.org>
Extropia's Resident System Guru
http://www.eXtropia.com/
When you rewrite a compiler from scratch, you sometimes fix
things you didn't know were broken.
-- Larry Wall
perl -e '$$=\${gozer};{$_=unpack(P26,pack(L,$$));/^Just Another Perl Hacker!\n$/&&print||$$++&&redo}'
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by Stas Bekman <st...@stason.org>.
Randal L. Schwartz wrote:
>>>>>>"Stas" == Stas Bekman <st...@stason.org> writes:
>>>>>>
>
> Stas> this is still nicer, as it does the split at compile time :
> Stas> qw(PATH IFS CDPATH ENV BASH_ENV)
>
> Only in recent Perls.
>
> For those of us still stuck at 5.5.3 (grumble grumble), it's
> a runtime split.
Thanks for the reminder, Randal.
But we really hope that we will be able to keep
require 5.6.1;
for mod_perl 2.0.
_____________________________________________________________________
Stas Bekman JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by "Randal L. Schwartz" <me...@stonehenge.com>.
>>>>> "Stas" == Stas Bekman <st...@stason.org> writes:
Stas> this is still nicer, as it does the split at compile time :
Stas> qw(PATH IFS CDPATH ENV BASH_ENV)
Only in recent Perls.
For those of us still stuck at 5.5.3 (grumble grumble), it's
a runtime split.
--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<me...@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by Stas Bekman <st...@stason.org>.
Ken Williams wrote:
>
> Stas Bekman <st...@stason.org> wrote:
>
>> According to perlsec manpage this is what should be done:
>>
>> $ENV{'PATH'} = '/bin:/usr/bin';
>> delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
>>
>> hence in this particular case the patch should be:
>>
>> local %ENV;
>> delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
>
>
>
> I'm a little late, but I just read this thread now. Using local() to save
> a temporary copy of the entire hash seems wasteful, because all you need to
> do is get rid of a few entries temporarily. You can do this instead:
> local @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV', 'PATH'};
> $ENV{'PATH'} = '/bin:/usr/bin';
nice, committed :)
this is still nicer, as it does the split at compile time :
qw(PATH IFS CDPATH ENV BASH_ENV)
_____________________________________________________________________
Stas Bekman JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by Ken Williams <ke...@forum.swarthmore.edu>.
Stas Bekman <st...@stason.org> wrote:
> According to perlsec manpage this is what should be done:
>
> $ENV{'PATH'} = '/bin:/usr/bin';
> delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
>
> hence in this particular case the patch should be:
>
> local %ENV;
> delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
I'm a little late, but I just read this thread now. Using local() to save
a temporary copy of the entire hash seems wasteful, because all you need
to
do is get rid of a few entries temporarily. You can do this instead:
local @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV', 'PATH'};
$ENV{'PATH'} = '/bin:/usr/bin';
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org
Re: [Patch] Apache::TestConfigParse and Taint mode
Posted by Stas Bekman <st...@stason.org>.
On Sat, 8 Sep 2001, Philippe M . Chiasson wrote:
> Small patch to supress an annoying taint warning
Philippe, please inline the patches, so we could comment on these.
> And btw, this isn't safe at all, isn't it? It's just bypassing the
> taint checking... Should it be fixed or what?
According to perlsec manpage this is what should be done:
$ENV{'PATH'} = '/bin:/usr/bin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
hence in this particular case the patch should be:
local %ENV;
delete @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
_____________________________________________________________________
Stas Bekman JAm_pH -- Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide http://perl.apache.org/guide
mailto:stas@stason.org http://apachetoday.com http://eXtropia.com/
http://singlesheaven.com http://perl.apache.org http://perlmonth.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@perl.apache.org
For additional commands, e-mail: dev-help@perl.apache.org