Re: data retrieved from database is unexpectedly tainted

2009-12-15 Thread Tim Bunce
On Tue, Dec 15, 2009 at 04:17:42PM +, Martin Evans wrote: > >> > >> I've no idea what is tainting the returned data but this is reproducible > >> for us here is a small amount of perl. > > > > From memory, perl tainting works on a per-statement basis. If a tainted > > value is accessed during

Re: data retrieved from database is unexpectedly tainted

2009-12-15 Thread Martin Evans
Tim Bunce wrote: > On Tue, Dec 15, 2009 at 02:53:03PM +, Martin Evans wrote: >> If you are using the latest DBI and Perl 5.10.0 or 5.10.1 and running in >> taint mode (but have not set DBI's Taint, TainTIn, TaintOut) then use >> tainted strings in the SQL you issue the resulting data is tainted

Re: data retrieved from database is unexpectedly tainted

2009-12-15 Thread Tim Bunce
On Tue, Dec 15, 2009 at 02:53:03PM +, Martin Evans wrote: > If you are using the latest DBI and Perl 5.10.0 or 5.10.1 and running in > taint mode (but have not set DBI's Taint, TainTIn, TaintOut) then use > tainted strings in the SQL you issue the resulting data is tainted. All > we were doing

Re: data retrieved from database is unexpectedly tainted

2009-12-15 Thread Martin Evans
Martin J. Evans wrote: > Martin J. Evans wrote: >> Hi, >> >> I've spent some time on this today and I am getting nowhere. Before I >> redouble my efforts I thought I'd post here just in case anything rings >> a bell with someone. >> >> We are using the latest DBI and DBD::Oracle to get data from an

Re: data retrieved from database is unexpectedly tainted

2009-12-14 Thread Martin J. Evans
Martin J. Evans wrote: > Hi, > > I've spent some time on this today and I am getting nowhere. Before I > redouble my efforts I thought I'd post here just in case anything rings > a bell with someone. > > We are using the latest DBI and DBD::Oracle to get data from an Oracle > data. All data is re

data retrieved from database is unexpectedly tainted

2009-12-14 Thread Martin J. Evans
Hi, I've spent some time on this today and I am getting nowhere. Before I redouble my efforts I thought I'd post here just in case anything rings a bell with someone. We are using the latest DBI and DBD::Oracle to get data from an Oracle data. All data is retrieved via reference cursor returned