web commit by adb

[ikiwiki.git] / doc / bugs / taint_issue_with_regular_expressions.mdwn

diff --git a/doc/bugs/taint_issue_with_regular_expressions.mdwn b/doc/bugs/taint_issue_with_regular_expressions.mdwn
index 174b4f1c52afbfd7719f3be6c9a59965e40cb969..5ba9e19f6ae042b4b4302bff4a99604a54015086 100644 (file)
--- a/doc/bugs/taint_issue_with_regular_expressions.mdwn
+++ b/doc/bugs/taint_issue_with_regular_expressions.mdwn
@@ -7,3 +7,25 @@ It works if I replace it with:
     my ($f)=/(^[-[:alnum:]_.:\/+]+$)/; # untaint
 
 which is exactly the same regular expression drawn out as a constant.  It appears that %config gets some tainted data and is itself being marked entirely tainted, which may prevent using regular expressions contained in it for untainting other data.  I'm using Perl 5.8.8.
     my ($f)=/(^[-[:alnum:]_.:\/+]+$)/; # untaint
 
 which is exactly the same regular expression drawn out as a constant.  It appears that %config gets some tainted data and is itself being marked entirely tainted, which may prevent using regular expressions contained in it for untainting other data.  I'm using Perl 5.8.8.

+
+> How could `%config` possible get tainted? That would be a major security
+> hole. It seems more likely that perl containes to have taint flag bugs
+> even in 5.8. See also: [[prune_causing_taint_mode_failures]],
+> [[Insecure_dependency_in_mkdir]],
+> [[Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn]],
+> and especially [[debbug 411786]]
+>
+> The last of those was the last straw for me, and I disabled taint
+> checking in the debian package. You can do the same by building ikiwiki
+> with NOTAINT=1. :-( --[[Joey]]
+
+----------------
+Continuing to dig into the problem I reported, it may not be taint after all.  Running strings on the ikiwiki.cgi wrapper, I see stuff like:
+
+    'wiki_file_regexp' => bless( do{\(my $o = undef)}, 'Regexp' )
+
+without any payload of the actual regexp, and that would also certainly also have the observed effect of the regexps being completely broken while running in CGI mode.  This seems to implicate Data::Dumper (2.101).  After upgrading Data::Dumper to 2.121 I get:
+
+    'wiki_file_regexp' => qr/(?-xism:(^[-[:alnum:]_.:\/+]+$))/
+
+This would call for at most an installation prerequisite of Data::Dumper >= 1.121.  A look at the module's changelog shows that no intervening versions were actually released, so 1.121 would be the minimal good one.