Changes between Version 13 and Version 14 of Doc/BasicConfig/AII

Timestamp:

Jul 9, 2008, 8:45:05 PM (16 years ago)

Author:

/DC=es/DC=irisgrid/O=uam/CN=luisf-munnoz

Comment:

Documentation for the tainted mode on AII.

Doc/BasicConfig/AII

@@ -146 +146 @@
 world_readable 1
 }}}
+
+=== Tainted mode warnings (Insecure dependency...) ===
+
+These messages indicate that you have clearly insecure hooks running, and that a fix is needed. AII runs in "tainted" mode, meaning that all input must be sanitized. On user hooks you'll usually find warnings when attempting to open a file that is given on the profile or when running a command, for instance:
+
+{{{
+my $filename = $config->getElement (SOME_PATH)->getValue ();
+open (FH, ">$filename");
+}}}
+
+will issue a warning, meaning that $filename must be sanitized. This a sanitized version:
+
+{{{
+my $filename = $config->getElement (SOME_PATH)->getValue ();
+if ($filename =~ m{^(/.+)$}) {
+    $filename = $1;
+} else {
+    throw_error ("Expected an absolute path on $filename");
+    return ();
+}
+open (FH, ">$filename");
+}}}
+
+Note that the above example assumes you expect an absolute path. If you expected something different (f.i, a path under /osinstall/ks), fix your regular expression accordingly.
+
+The same applies when you run commands:
+
+{{{
+my $param = $config->getElement (SOME_OTHER_PATH)->getValue ();
+# $param is tainted!!!
+system ("ls", "$param");
+}}}
+
+will fail, so you'll have to specify what you are expecting exactly:
+
+{{{
+my $param = $config->getElement (SOME_OTHER_PATH)->getValue ();
+# I expected just a bunch of flags!!
+if ($param =~ m{^(-[-=\w]+)$}) {
+    $param = $1;
+} else {
+    throw_error ("Unexpected flags passed to the command");
+    return ();
+}
+system ("ls", $param);
+}}}
+
+When you get a warning, it will point out the line where the insecure data is used, but please fix it on the place where such insecure data is received. It will reduce a lot your code and efforts.
+
+You'll find more information on the tainted mode on {{{perlsec}}} man page.