Mailing List Archive

> From: Jeff Okamoto <okamoto@hpcc123.corp.hp.com>
>
> How can I turn off the AutoLoader in Socket.pm? I'm running the WWW library's
> LWP::UserAgent in a setuid script. I did find the useEval method to turn off
> eval's inside LWP, but inside the AUTOLOAD sub of Socket.pm is a nice fat eval.
> Is there a workaround to using the AutoLoader in this case?

Could you explain more about what you're trying to achieve and why?

Tim.

>> From: Jeff Okamoto <okamoto@hpcc123.corp.hp.com>
>>
>> How can I turn off the AutoLoader in Socket.pm? I'm running the WWW l<SNIP>
>> LWP::UserAgent in a setuid script. I did find the useEval method to t<SNIP>
>> eval's inside LWP, but inside the AUTOLOAD sub of Socket.pm is a nice <SNIP>
>> Is there a workaround to using the AutoLoader in this case?

>Could you explain more about what you're trying to achieve and why?


Probably the eval here is what it doesn't like:

eval {require $name};

the taint checker is probably a little nervous about it.

--mot

> From: Tom Christiansen <tchrist@mox.perl.com>
>
> >> From: Jeff Okamoto <okamoto@hpcc123.corp.hp.com>
> >>
> >> How can I turn off the AutoLoader in Socket.pm? I'm running the WWW l<SNIP>
> >> LWP::UserAgent in a setuid script. I did find the useEval method to t<SNIP>
> >> eval's inside LWP, but inside the AUTOLOAD sub of Socket.pm is a nice <SNIP>
> >> Is there a workaround to using the AutoLoader in this case?
>
> >Could you explain more about what you're trying to achieve and why?
>
> Probably the eval here is what it doesn't like:
>
> eval {require $name};
>
> the taint checker is probably a little nervous about it.

Umm, should we untaint $name?

Tim.

> Could you explain more about what you're trying to achieve and why?

I have a setuid program that is exec'ing a perl script which uses the
libwww module, which calls the Socket module. The eval in Socket.pm
is causing the taint checker to spit out an "Insecure dependency in
eval". I can also get this by adding the -T flag to the perl script
and simply calling it from the prompt.

Jeff

> From: Jeff Okamoto <okamoto@hpcc123.corp.hp.com>
>
> > Could you explain more about what you're trying to achieve and why?
>
> I have a setuid program that is exec'ing a perl script which uses the
> libwww module, which calls the Socket module. The eval in Socket.pm
> is causing the taint checker to spit out an "Insecure dependency in
> eval". I can also get this by adding the -T flag to the perl script
> and simply calling it from the prompt.

Okay. Untainting $name in the AutoLoader seems reasonable.

Tim.

> Okay. Untainting $name in the AutoLoader seems reasonable.

Only if you limit it to identifers. I don't want anyone
doing funny tricks like *{"../../../barstuff"} = \&darnit
or something to get the autocalled with that as the function to
execute. You could do the untainting using a /(\w+)/ kind
of match instead of a .* one to avoid that problem.

--tom