Phil Pennock <p...@exim.org> (So 12 Feb 2017 12:30:48 CET): > On 2017-02-12 at 11:30 +0100, Heiko Schlittermann wrote: > > I saw, that '.' now gets pop()ed from @INC in various Perl scripts. > > > > Is there a special reason doing so? If we'd deal with security in mind, > > we should use Perl's taint mode to make the scripts more secure. > > Root invokes these scripts, often for messing with queue analysis. > Invoking them in /tmp is entirely reasonable. Other people can write to > /tmp, so letting people have code be run as root because root invoked an > Exim tool while in /tmp is poor form.
Yes. But '.' is the last in the @INC array. So, if Perl looks for a module in '.', it already failed finding it in all the other (system) locations. If we remove '.' from the @INC array, we should care about other positions too, not only the last position. BEGIN { @INC = grep { !/^[.]$/ } @INC } But this prevents a developer from temporarly using '.' in the very first position of @INC for testing purpose as in perl -Mlib='.' exigrep or PERL5LIB='.' exigrep But, as it's a developer, one can use PERL5LIB=$(pwd) exigrep Conclusion: removing the DOT is appreciated, but, if doing so, it should be done completly, shouldn't it? > Taint mode deals with when the invoker's environment is not trusted. > It's excellent for daemons, CGIs, network protocol clients, etc. It's > less useful for CLI tools which don't talk to untrusted services. I'm > not opposed to it I just don't see the point here. > > Taint mode doesn't really protect against @INC being stupid. Taint mode removes any '.' from @INC, and lets Perl ignore PERL{5,}LIB, and PERL5OPT. While allowing you to put it back into @INC via perl -T -I. exigrep Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -
signature.asc
Description: Digital signature
-- ## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##