From b7ee89cee3c5aae4c446f4045b031f8bf83c927e Mon Sep 17 00:00:00 2001 From: Andrew Pimlott Date: Thu, 5 Oct 2000 09:20:58 -0400 Subject: [PATCH] [ID 20001005.004] doc bug: perlsec misleading re file output Message-Id: p4raw-id: //depot/perl@7515 --- pod/perlsec.pod | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/pod/perlsec.pod b/pod/perlsec.pod index 6b50b92..16b439c 100644 --- a/pod/perlsec.pod +++ b/pod/perlsec.pod @@ -38,9 +38,22 @@ msgrcv(), the password, gcos and shell fields returned by the getpwxxx() calls), and all file input are marked as "tainted". Tainted data may not be used directly or indirectly in any command that invokes a sub-shell, nor in any command that modifies files, -directories, or processes. (B: If you pass a list -of arguments to either C or C, the elements of that list -are B checked for taintedness.) Any variable set to a value +directories, or processes, B: + +=over 4 + +=item * + +If you pass a list of arguments to either C or C, +the elements of that list are B checked for taintedness. + +=item * + +Arguments to C and C are B checked for taintedness. + +=back + +Any variable set to a value derived from tainted data will itself be tainted, even if it is logically impossible for the tainted data to alter the variable. Because taintedness is associated with each scalar value, some -- 2.7.4