[tpm] Taint question

Madison Kelly linux at alteeve.com
Thu Aug 30 10:53:54 PDT 2007


Shaun Fryer wrote:
> The culprit is 'use locale' (try commenting it out). Maybe someone else
> can explain why, but I'm guessing from the man page that it messes with
> how perl compiles regexes. Sadly, if you replace your regex with /(.*)/,
> it becomes untainted, even with 'use locale'.
> --
>     Shaun Fryer

*sigh*

This I suspected, but feared.

My program is (as best I can make it) internationalized and supports 
non-ascii characters (like Japanese *kana/kanji). I understood (perhaps 
wrongly) that using locale (et. al.) changed the definition of '\w', 
length(), etc to recognize these characters. Shouldn't this flow to 
taint? Obviously, it doesn't seem to though...

Using (.*?) is essentially the same as giving up on taint all together. 
This isn't desirable. :)

Thanks!!

The still curious Madi


More information about the toronto-pm mailing list