At 7:38 AM -0400 10/6/05, John E. Malmberg wrote: > >On VMS, it is possible logical names that are not in the EXEC or higher >privileged mode should be considered tainted, and ones that in the EXEC mode >or higher should not be, if I understand what tainting is supposed to do. > >I do not think that Perl on VMS is making that distinction now, and I do not >know how to implement such a change.
If you hunt on the word "secure" in vms/vms.c:Perl_vmsstrenv() you'll see that something very much like what you describe is already in place. There are various configure-time options controlling this as well. > >Also the underlying C library still trusts the logicals names that could be >tainted, unless the Perl interpreter is installed with privilege and attempts >to dynamically load another image. In that case logical names that could be >modified by non-privileged users are ignored. The first thing Perl does when it starts up on VMS is disable image privileges. -- ________________________________________ Craig A. Berry mailto:[EMAIL PROTECTED] "... getting out of a sonnet is much more difficult than getting in." Brad Leithauser
