urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

web commit by adb

master
Joey Hess 2008-01-05 01:01:11 -05:00
parent f22558faed
commit f9fa96ded7
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
doc/bugs/taint_issue_with_regular_expressions.mdwn 100644
View File

@ -0,0 +1,9 @@
Built from 2.1.17 source, works fine on commandline, but not working from CGI wrapper. Traced problem to regular expressions failing to match, specifically in contexts like the following in Render.pm:
my ($f)=/$config{wiki_file_regexp}/; # untaint
It works if I replace it with:
my ($f)=/(^[-[:alnum:]_.:\/+]+$)/; # untaint
which is exactly the same regular expression drawn out as a constant. It appears that %config gets some tainted data and is itself being marked entirely tainted, which may prevent using regular expressions contained in it for untainting other data. I'm using Perl 5.8.8.