Phil Pennock <pdp@???> (So 12 Feb 2017 12:30:48 CET):
> On 2017-02-12 at 11:30 +0100, Heiko Schlittermann wrote:
> > I saw, that '.' now gets pop()ed from @INC in various Perl scripts.
> >
> > Is there a special reason doing so? If we'd deal with security in mind,
> > we should use Perl's taint mode to make the scripts more secure.
>
> Root invokes these scripts, often for messing with queue analysis.
> Invoking them in /tmp is entirely reasonable. Other people can write to
> /tmp, so letting people have code be run as root because root invoked an
> Exim tool while in /tmp is poor form.
Yes. But '.' is the last in the @INC array.
So, if Perl looks for a module in '.', it already failed finding it in
all the other (system) locations.
If we remove '.' from the @INC array, we should care about other
positions too, not only the last position.
BEGIN {
@INC = grep { !/^[.]$/ } @INC
}
But this prevents a developer from temporarly using '.' in the very
first position of @INC for testing purpose as in
perl -Mlib='.' exigrep
or
PERL5LIB='.' exigrep
But, as it's a developer, one can use
PERL5LIB=$(pwd) exigrep
Conclusion: removing the DOT is appreciated, but, if doing so, it should
be done completly, shouldn't it?
> Taint mode deals with when the invoker's environment is not trusted.
> It's excellent for daemons, CGIs, network protocol clients, etc. It's
> less useful for CLI tools which don't talk to untrusted services. I'm
> not opposed to it I just don't see the point here.
>
> Taint mode doesn't really protect against @INC being stupid.
Taint mode removes any '.' from @INC, and lets Perl ignore
PERL{5,}LIB, and PERL5OPT. While allowing you to put it
back into @INC via
perl -T -I. exigrep
Best regards from Dresden/Germany
Viele Grüße aus Dresden
Heiko Schlittermann
--
SCHLITTERMANN.de ---------------------------- internet & unix support -
Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
gnupg encrypted messages are welcome --------------- key ID: F69376CE -
! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -
