Skip Menu |
 

This queue is for tickets about the MIME-tools CPAN distribution.

Report information
The Basics
Id: 67119
Status: resolved
Priority: 0/
Queue: MIME-tools

People
Owner: dfs+pause [...] roaringpenguin.com
Requestors: Mark.Martinec [...] ijs.si
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: Unwarranted laundering of tainted mime_attr and mime_type
Date: Thu, 31 Mar 2011 16:44:19 +0200
To: bug-MIME-tools [...] rt.cpan.org
From: Mark Martinec <Mark.Martinec [...] ijs.si>
Download (untitled) / with headers
text/plain 1.2k
MIME-tools version 5.502 as well as 5.420 are taint-laundering MIME attributes and MIME type (and possibly other data). I believe this is unintentional and unwarranted, circumventing the taint security concept/intention. Example: $ perl -MMIME::Parser -MScalar::Util -Te ' $h=MIME::Parser->new->parse(\*STDIN)->head; $ht=$h->mime_type; $hn=$h->mime_attr("content-type.name"); printf("%d, %s\n", Scalar::Util::tainted($ht),$ht); printf("%d, %s\n", Scalar::Util::tainted($hn),$hn)' Content-Type: $path; name=$shell ^Z 0, $path 0, $shell (should be a '1' instead of a '0' in the result) Attached is a patch to fix the problem. There are two things needed for a solution: avoiding implicit untainting by regexp captures unless explicitly required, and a workaround for a [perl #87336] bug: http://rt.perl.org/rt3/Ticket/Display.html?id=87336 I find it most convenient to have: use re 'taint'; in all modules, and override it only locally in a block where necessary, e.g.: { no re 'taint'; # allow untainting /...($1).../; $result = $1; } Btw, my meticulous localizing of $1, $2, ... is due to a [perl #67962] bug: http://rt.perl.org/rt3/Public/Bug/Display.html?id=67962 fixed in 5.13, but doesn't hurt anywhere as a matter of good practice. Mark

Message body is not shown because sender requested not to inline it.

Subject: Re: [rt.cpan.org #67119] Unwarranted laundering of tainted mime_attr and mime_type
Date: Thu, 31 Mar 2011 11:09:47 -0400
To: bug-MIME-tools [...] rt.cpan.org
From: "David F. Skoll" <dfs [...] roaringpenguin.com>
Download (untitled) / with headers
text/plain 150b
Hi, Mark, Thanks very much for your patch. I have applied it in my git tree and the fixes will be in the next MIME-tools release. Regards, David.
Download (untitled) / with headers
text/plain 108b
Hi, I have just uploaded MIME-tools-5.503 to CPAN, which I believe resolves this ticket. Regards, David.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.