Hacker News Reader

Did they consider doing tainting (like Perl)? Input strings are marked as tainted and anything derived from them, except for some specific operations that untaint strings. If you use a tainted string for a security-sensitive operation then it fails. http://perlmeme.org/howtos/secure_code/taint.html

View on HN

That's very interesting. That link is dead though.

I think the broken link refers to the same information found here [0].

One of the nicest AND most frustrating parts of taint-mode, for myself, is that once activated it remains on until the end of execution. It's not scoped, which removes some of the headache of using such a thing. Switch on, and assume always on.

[0] https://perldoc.perl.org/perlsec#Taint-mode

Back when we were writing websites in Perl (cough, 20 years ago), we also had taint mode on everywhere. It was fairly unobtrusive, and likely stopped a few attacks like:

http://example.com/upload.pl?file=../../../../etc/passwd

The main thing you had to remember was the parameters (all tainted of course) had to be filtered through a regular expression before you could use them.

Reply on news.ycombinator.com