Programming Perl, 4th Edition

Defeating Taint Checking

Taint mode is a development tool to help you find where you need to cleanse data. It’s not a guarantee that nothing bad will happen with your program, so bad things can still happen. It’s very easy to get around it, in fact.

The –T command-line switch forces taint checking, and you can put that on your shebang line:

#!/usr/bin/perl –T

system 'echo', $ARGV[0];

If run from the command line with perl and no –T, it fails:

% perl echo.pl
"–T" is on the #! line, it must also be used on the command line

The crafty user can turn on taint mode but turn the normally fatal messages into warnings. The –t switch turns on taint mode but only warns about violations. The system still accepts tainted data:

% perl –t echo.pl Amelia
Insecure $ENV{PATH} while running with –t switch
Insecure dependency in system while running with –t switch
Insecure $ENV{PATH} while running with –t switch
Amelia

Running as setuid, where taint mode is automatically on, is similarly defeated with –u:

% perl –t echo.pl Amelia
Insecure $ENV{PATH} while running with –t switch
Insecure dependency in system while running with –t switch
Insecure $ENV{PATH} while running with –t switch
Amelia

Similarly, the –U switch allows perl to run “unsafe” operations, but you still need to specify –T:

% perl –TU echo.pl Amelia
Amelia

If you want the warnings back, use –w:

% perl –TU –w echo.pl Amelia Insecure $ENV{PATH} while running with –t switch Insecure dependency in system while running with –t switch Insecure $ENV{PATH} ...