Re: Taint mode user supplied file names

2009-08-26 Thread Mark Wagner
On Mon, Aug 24, 2009 at 06:06, Tim Bowdentim.bow...@mapforge.com.au wrote: On Mon, 2009-08-24 at 14:46 +0200, Rob Coops wrote: snip In your case where you run the script from a command line you will still want to make sure that a user is not for instance printing a socket or some part of the

Re: Taint mode user supplied file names

2009-08-26 Thread Tim Bowden
On Wed, 2009-08-26 at 14:48 -0700, Mark Wagner wrote: On Mon, Aug 24, 2009 at 06:06, Tim Bowdentim.bow...@mapforge.com.au wrote: On Mon, 2009-08-24 at 14:46 +0200, Rob Coops wrote: snip In your case where you run the script from a command line you will still want to make sure that a

Taint mode user supplied file names

2009-08-24 Thread Tim Bowden
#!/usr/bin/perl -wT use strict; my $filename = shift @ARGV; if (-f $filename){ open OUT, $filename.new or die can't open $filename.new: $!; print OUT are we safe?\n; close OUT; } This dies with Insecure dependency in open while running with -T switch as expected. I'd like to know if

Re: Taint mode user supplied file names

2009-08-24 Thread Rob Coops
On Mon, Aug 24, 2009 at 2:17 PM, Tim Bowden tim.bow...@mapforge.com.auwrote: #!/usr/bin/perl -wT use strict; my $filename = shift @ARGV; if (-f $filename){ open OUT, $filename.new or die can't open $filename.new: $!; print OUT are we safe?\n; close OUT; } This dies with Insecure

Re: Taint mode user supplied file names

2009-08-24 Thread Tim Bowden
On Mon, 2009-08-24 at 14:46 +0200, Rob Coops wrote: On Mon, Aug 24, 2009 at 2:17 PM, Tim Bowden tim.bow...@mapforge.com.auwrote: #!/usr/bin/perl -wT use strict; my $filename = shift @ARGV; if (-f $filename){ open OUT, $filename.new or die can't open $filename.new: $!; print