po todo update: this has been fixed already.

[git.ikiwiki.info.git] / doc / bugs / taint_issue_with_regular_expressions.mdwn

diff --git a/doc/bugs/taint_issue_with_regular_expressions.mdwn b/doc/bugs/taint_issue_with_regular_expressions.mdwn
index e05a59879d7b32a508ecb212fde35652a6c3df7a..172b49fd1a6dc1ece49ae7de4183cdcc9af0cba8 100644 (file)
--- a/doc/bugs/taint_issue_with_regular_expressions.mdwn
+++ b/doc/bugs/taint_issue_with_regular_expressions.mdwn
@@ -12,11 +12,24 @@ which is exactly the same regular expression drawn out as a constant.  It appear
 > hole. It seems more likely that perl containes to have taint flag bugs
 > even in 5.8. See also: [[prune_causing_taint_mode_failures]],
 > [[Insecure_dependency_in_mkdir]],
 > hole. It seems more likely that perl containes to have taint flag bugs
 > even in 5.8. See also: [[prune_causing_taint_mode_failures]],
 > [[Insecure_dependency_in_mkdir]],

-> [[Insecure_dependency_in_eval_while_running_with_-T_switch.mdwn]],
-> and especially [[debbug 411786]]
+> [[Insecure_dependency_in_eval_while_running_with_-T_switch]],
+> and especially [[!debbug 411786]]

 >
 > The last of those was the last straw for me, and I disabled taint
 > checking in the debian package. You can do the same by building ikiwiki
 > with NOTAINT=1. :-( --[[Joey]]
 
 >
 > The last of those was the last straw for me, and I disabled taint
 > checking in the debian package. You can do the same by building ikiwiki
 > with NOTAINT=1. :-( --[[Joey]]
 

-[[tag done]]
+----------------
+Continuing to dig into the problem I reported, it may not be taint after all.  Running strings on the ikiwiki.cgi wrapper, I see stuff like:
+
+    'wiki_file_regexp' => bless( do{\(my $o = undef)}, 'Regexp' )
+
+without any payload of the actual regexp, and that would also certainly also have the observed effect of the regexps being completely broken while running in CGI mode.  This seems to implicate Data::Dumper (2.101).  After upgrading Data::Dumper to 2.121 I get:
+
+    'wiki_file_regexp' => qr/(?-xism:(^[-[:alnum:]_.:\/+]+$))/
+
+This would call for at most an installation prerequisite of Data::Dumper >= 1.121.  A look at the module's changelog shows that no intervening versions were actually released, so 1.121 would be the minimal good one.
+
+> You must have a very old version of perl there. This seems to be a bug in
+> data dumper before 2.11, which didn't properly dump q// objects. Prereq
+> added, [[done]] --[[Joey]]