Re: Proposed (optional) kwalitee metric; use re 'taint'

2008-06-23 Thread Thomas Klausner
Hi! On Tue, Jun 24, 2008 at 03:57:26PM +1000, Paul Fenwick wrote: > * What's the procedure of getting this added to the CPANTS list > of kwalitee metrics? Either you wait until I have tuits (but to tell the truth there are some more issues to fix with CPANTS before I can add more

Re: Proposed (optional) kwalitee metric; use re 'taint'

2008-06-23 Thread chromatic
On Monday 23 June 2008 22:57:26 Paul Fenwick wrote: > As such, I'd like to propose a new (optional) kwalitee metric. Like using > strict and warnings, modules should "use re 'taint'" at the top of the code > as well. Even modules that exist to untaint data *should* be doing this, > as it means t

Proposed (optional) kwalitee metric; use re 'taint'

2008-06-23 Thread Paul Fenwick
G'day everyone, This week I'm spending an awful lot of time thinking about Perl Security in preparation for a tutorial I'm giving at OSCON. One thing that repeatedly comes up is that it's very easy for modules to accidentally untaint data. That can be very bad, since it means that data from a