[tpm] Taint question
linux at alteeve.com
Thu Aug 30 10:53:54 PDT 2007
Shaun Fryer wrote:
> The culprit is 'use locale' (try commenting it out). Maybe someone else
> can explain why, but I'm guessing from the man page that it messes with
> how perl compiles regexes. Sadly, if you replace your regex with /(.*)/,
> it becomes untainted, even with 'use locale'.
> Shaun Fryer
This I suspected, but feared.
My program is (as best I can make it) internationalized and supports
non-ascii characters (like Japanese *kana/kanji). I understood (perhaps
wrongly) that using locale (et. al.) changed the definition of '\w',
length(), etc to recognize these characters. Shouldn't this flow to
taint? Obviously, it doesn't seem to though...
Using (.*?) is essentially the same as giving up on taint all together.
This isn't desirable. :)
The still curious Madi
More information about the toronto-pm