urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

response, improve NOTAINT docs

master
Joey Hess 2008-01-05 02:07:29 -05:00
parent b81eabe8a6
commit 9589b7a83c
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
README
View File

@ -4,7 +4,10 @@ documentation wiki and a man page, and "make install" will install ikiwiki.
A few special variables you can set while using the Makefile:
PROFILE=1 turns on profiling for the build of the doc wiki. Uses Devel::Profile
NOTAINT=1 turns off the taint flag in the ikiwiki program
NOTAINT=1 turns off the taint flag in the ikiwiki program. (Recommended
unless your perl is less buggy than mine -- see
http://bugs.debian.org/411786)
All other documentation is in the ikiwiki documentation wiki, which is also
available online at <http://ikiwiki.info/>

13
doc/bugs/taint_issue_with_regular_expressions.mdwn
View File

@ -7,3 +7,16 @@ It works if I replace it with:
my ($f)=/(^[-[:alnum:]_.:\/+]+$)/; # untaint
which is exactly the same regular expression drawn out as a constant. It appears that %config gets some tainted data and is itself being marked entirely tainted, which may prevent using regular expressions contained in it for untainting other data. I'm using Perl 5.8.8.
> How could `%config` possible get tainted? That would be a major security
> hole. It seems more likely that perl containes to have taint flag bugs
> even in 5.8. See also: [[prune_causing_taint_mode_failures]],
> [[Insecure_dependency_in_mkdir]],
> [[Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn]],
> and especially [[debbug 411786]]
>
> The last of those was the last straw for me, and I disabled taint
> checking in the debian package. You can do the same by building ikiwiki
> with NOTAINT=1. :-( --[[Joey]]
[[tag done]]