Fix Cwd::getcwd() not being tainted, as noticed
Jarkko Hietaniemi [Tue, 4 Sep 2001 21:03:17 +0000 (21:03 +0000)]
by Schwern.

p4raw-id: //depot/perl@11873

MANIFEST
ext/Cwd/Cwd.xs
ext/Cwd/t/cwd.t [moved from ext/Cwd/Cwd.t with 100% similarity]
ext/Cwd/t/taint.t [new file with mode: 0644]
util.c

index 696f98e..a515969 100644 (file)
--- a/MANIFEST
+++ b/MANIFEST
@@ -103,9 +103,10 @@ ext/ByteLoader/byterun.c   Runtime support for bytecode loader
 ext/ByteLoader/byterun.h       Header for byterun.c
 ext/ByteLoader/hints/sunos.pl  Hints for named architecture
 ext/ByteLoader/Makefile.PL     Bytecode loader makefile writer
-ext/Cwd/Cwd.t          See if Cwd works
-ext/Cwd/Cwd.xs         Cwd extension external subroutines
-ext/Cwd/Makefile.PL    Cwd extension makefile maker
+ext/Cwd/Cwd.xs                 Cwd extension external subroutines
+ext/Cwd/t/cwd.t                        See if Cwd works
+ext/Cwd/t/taint.t              See if Cwd works with taint
+ext/Cwd/Makefile.PL            Cwd extension makefile maker
 ext/Data/Dumper/Changes                Data pretty printer, changelog
 ext/Data/Dumper/Dumper.pm      Data pretty printer, module
 ext/Data/Dumper/Dumper.xs      Data pretty printer, externals
index 303ef70..a82404f 100644 (file)
@@ -226,22 +226,20 @@ PPCODE:
 {
     dXSTARG;
     char *path;
-    STRLEN len;
     char buf[MAXPATHLEN];
 
-    if (pathsv)
-      path = SvPV(pathsv, len);
-    else {
-        path = ".";
-        len  = 1;
-    }
+    path = pathsv ? SvPV_nolen(pathsv) : ".";
 
     if (bsd_realpath(path, buf)) {
         sv_setpvn(TARG, buf, strlen(buf));
         SvPOK_only(TARG);
+       SvTAINTED_on(TARG);
     }
     else
-      sv_setsv(TARG, &PL_sv_undef);
+        sv_setsv(TARG, &PL_sv_undef);
 
     XSprePUSH; PUSHTARG;
+#ifndef INCOMPLETE_TAINTS
+    SvTAINTED_on(TARG);
+#endif
 }
similarity index 100%
rename from ext/Cwd/Cwd.t
rename to ext/Cwd/t/cwd.t
diff --git a/ext/Cwd/t/taint.t b/ext/Cwd/t/taint.t
new file mode 100644 (file)
index 0000000..036b2b1
--- /dev/null
@@ -0,0 +1,21 @@
+#!./perl -Tw
+# Testing Cwd under taint mode.
+
+BEGIN {
+    chdir 't' if -d 't';
+    @INC = '../lib';
+}
+
+use Cwd;
+use Test::More tests => 2;
+
+# The normal kill() trick is not portable.
+sub is_tainted { 
+    return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 };
+}
+
+my $cwd;
+eval { $cwd = getcwd; };
+is( $@, '',                 'getcwd() does not explode under taint mode' );
+ok( is_tainted($cwd),       "it's return value is tainted" );
+
diff --git a/util.c b/util.c
index 5c5da23..0026909 100644 (file)
--- a/util.c
+++ b/util.c
@@ -3719,6 +3719,10 @@ Perl_getcwd_sv(pTHX_ register SV *sv)
 {
 #ifndef PERL_MICRO
 
+#ifndef INCOMPLETE_TAINTS
+    SvTAINTED_on(sv);
+#endif
+
 #ifdef HAS_GETCWD
     {
        char buf[MAXPATHLEN];