to call functions B<outside> your Perl code, such as POSIX::system,
in which case they are able to run arbitrary external code.
+=item *
+
+Hash keys are B<never> tainted.
+
=back
For efficiency reasons, Perl takes a conservative view of
Because taintedness is associated with each scalar value, some
elements of an array or hash can be tainted and others not.
-The keys of a hash are never tainted.
+The keys of a hash are B<never> tainted.
For example:
will automagically remove any duplicated directories, while the later
will not.
+Note that if a tainted string is added to C<@INC>, the following
+problem will be reported:
+
+ Insecure dependency in require while running with -T switch
+
=head2 Cleaning Up Your Path
-For "Insecure C<$ENV{PATH}>" messages, you need to set C<$ENV{'PATH'}> to a
-known value, and each directory in the path must be non-writable by others
-than its owner and group. You may be surprised to get this message even
-if the pathname to your executable is fully qualified. This is I<not>
-generated because you didn't supply a full path to the program; instead,
-it's generated because you never set your PATH environment variable, or
-you didn't set it to something that was safe. Because Perl can't
-guarantee that the executable in question isn't itself going to turn
-around and execute some other program that is dependent on your PATH, it
-makes sure you set the PATH.
+For "Insecure C<$ENV{PATH}>" messages, you need to set C<$ENV{'PATH'}> to
+a known value, and each directory in the path must be absolute and
+non-writable by others than its owner and group. You may be surprised to
+get this message even if the pathname to your executable is fully
+qualified. This is I<not> generated because you didn't supply a full path
+to the program; instead, it's generated because you never set your PATH
+environment variable, or you didn't set it to something that was safe.
+Because Perl can't guarantee that the executable in question isn't itself
+going to turn around and execute some other program that is dependent on
+your PATH, it makes sure you set the PATH.
The PATH isn't the only environment variable which can cause problems.
Because some shells may use the variables IFS, CDPATH, ENV, and
language, not just Perl).
If you're concerned about people profiting from your code, then the
-bottom line is that nothing but a restrictive licence will give you
+bottom line is that nothing but a restrictive license will give you
legal security. License your software and pepper it with threatening
statements like "This is unpublished proprietary software of XYZ Corp.
Your access to it does not give you permission to use it blah blah
-blah." You should see a lawyer to be sure your licence's wording will
+blah." You should see a lawyer to be sure your license's wording will
stand up in court.
=head2 Unicode
makes generating such naughty hash keys harder.
See L<perlrun/PERL_HASH_SEED> for more information.
-The random perturbation is done by default but if one wants for some
-reason emulate the old behaviour one can set the environment variable
-PERL_HASH_SEED to zero (or any other integer). One possible reason
-for wanting to emulate the old behaviour is that in the new behaviour
-consecutive runs of Perl will order hash keys differently, which may
-confuse some applications (like Data::Dumper: the outputs of two
-different runs are no more identical).
+In Perl 5.8.1 the random perturbation was done by default, but as of
+5.8.2 it is only used on individual hashes if the internals detect the
+insertion of pathological data. If one wants for some reason emulate the
+old behaviour (and expose oneself to DoS attacks) one can set the
+environment variable PERL_HASH_SEED to zero to disable the protection
+(or any other integer to force a known perturbation, rather than random).
+One possible reason for wanting to emulate the old behaviour is that in the
+new behaviour consecutive runs of Perl will order hash keys differently,
+which may confuse some applications (like Data::Dumper: the outputs of two
+different runs are no longer identical).
B<Perl has never guaranteed any ordering of the hash keys>, and the
ordering has already changed several times during the lifetime of
=item *
-Regular expressions - Perl's regular expression engine is so called
-NFA (Non-Finite Automaton), which among other things means that it can
-rather easily consume large amounts of both time and space if the
+Regular expressions - Perl's regular expression engine is so called NFA
+(Non-deterministic Finite Automaton), which among other things means that
+it can rather easily consume large amounts of both time and space if the
regular expression may match in several ways. Careful crafting of the
regular expressions can help but quite often there really isn't much
one can do (the book "Mastering Regular Expressions" is required
Sorting - the quicksort algorithm used in Perls before 5.8.0 to
implement the sort() function is very easy to trick into misbehaving
-so that it consumes a lot of time. Nothing more is required than
-resorting a list already sorted. Starting from Perl 5.8.0 a different
-sorting algorithm, mergesort, is used. Mergesort is insensitive to
-its input data, so it cannot be similarly fooled.
+so that it consumes a lot of time. Starting from Perl 5.8.0 a different
+sorting algorithm, mergesort, is used by default. Mergesort cannot
+misbehave on any input.
=back
See L<http://www.cs.rice.edu/~scrosby/hash/> for more information,
-and any computer science text book on the algorithmic complexity.
+and any computer science textbook on algorithmic complexity.
=head1 SEE ALSO
projects / p5sagit/p5-mst-13.2.git / blobdiff