Re: [Boston.pm] Historical question: origin of the idea of tainting
Bill Ricker via Boston-pm <[email protected]> Wed, 17 Apr 2019 16:50:47 -0400
| Newsgroups | gmane.comp.lang.perl.perl-mongers.boston |
|---|---|
| Organization | The Perl Shop |
| Message-ID | <[email protected]> |
On 4/17/19 13:15, Andy Oram wrote: > Ah, so now it goes back to the 1980s! Thanks. Yes, Taint was originally for trying to make SETUID scripts safe from injection attacks via CLI arguments (@ARGV) on multiuser UNIX (POSIX) systems ... before Linux, before WWW. Because Perl originally scratched Larry's itch as a Usenet Newsadmin / Sysadmin back in the day. Alas any late binding is unsafe with SETUID, so setuid interpretative scripts eventually had to be banned entirely. (Dynamic library binding by a executable is unsafe, but not specifically banned. Yet.) But that meant Perl had Taint mode ready and waiting as a solution when WWW required CGI scripts which required injection-proofing. -- Bill Ricker independent contractor for The Perl Shop _______________________________________________ Boston-pm mailing list [email protected] https://mail.pm.org/mailman/listinfo/boston-pm