-
Notifications
You must be signed in to change notification settings - Fork 527
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hash keys forget taintedness #22137
Comments
Actually, now I mention that, Still, as a quirk, I wonder whether it could be fixed. Either the HEK structure or the HE structure could store an additional bit to say if the key data should be considered tainted. |
On Thu, 11 Apr 2024 at 16:55, Paul Evans ***@***.***> wrote:
The documentation on taint mode says that the only way to remove taint
from a value is to perform a regexp capture on it, and look at the capture
buffers
Actually, now I mention that, perlsec does talk about this.
Still, as a quirk, I wonder whether it could be fixed. Either the HEK
structure or the HE structure could store an additional bit to say if the
key data should be considered tainted.
I suspect that would break a lot of existing code. Personally I view taint
as a failed experiment in software design, I dont think its worth trying to
improve it.
Also it raises weird questions, what should happen if I store a tainted key
in a hash, and then later store the same key, but untainted.
cheers,
Yves
--
perl -Mre=debug -e "/just|another|perl|hacker/"
|
That would change behavior that's been in perl since 5.0 (I think) and documented (in perlsec) since 2003 (commit 595bde1). I bet there is code out there that depends on this. You can't even reasonably change it locally (behind Anyway, what is the documentation that says the only way to remove taint from a value is to perform a regexp capture on it? I thought the only page that talks about taint mode in detail was perlsec, which does mention the hash keys thing (three times). |
This behavior is documented and consistent with Perl's taint mode design. This should work; use v5.36; my $val = "value"; my %h; sub taint_keys { |
The documentation on taint mode says that the only way to remove taint from a value is to perform a regexp capture on it, and look at the capture buffers. Not so - it turns out that the keys of hashes forget their taintedness too.
If hash keys remembered taintedness I would have expected the last line to read
The text was updated successfully, but these errors were encountered: