modperl_untainting_input

This is part of The Pile, a partial archive of some open source mailing lists and newsgroups.



To: :
From: Joachim Zobel <nc-zobeljo@netcologne.de>
Subject: Re: Santitizing errors with mod_perl
Date: Sat, 28 Jul 2001 00:16:39 +0200

At 03:37 27.07.01 -0500, you wrote:
>I sanitize all my input in my scripts to only allow chars i want allowed. My
>working lines before using modperl and for some reason kick out error with
>mod perl are as follows:
>
>$user =~ s/[^$OK_CHARS]//go;
>$pass =~ s/[^$OK_CHARS]//go;
>
>When an account is created i only allow chars from the list $OK_CHARS this
>works with non modperl apache but not with modperl enabled apache?
>
>The error in the log states:
>
>[error] Unmatched [ before HERE mark in regex m/[ << HERE ^]/ at
>libwelcome.pl line 169.

There is nothing changed with regexes. Either $OK_CHARS is a global that 
has been changed from another script or some Apache module has redefined it 
or ...?

What does a "warn $OK_CHARS;" write to your error log.

Hth,
Joachim

===


the rest of The Pile (a partial mailing list archive)

doom@kzsu.stanford.edu