[Rt-devel] taint checks when running GID

[Brent B. Powers]

Last spring, a couple of people had sudden onset of taint problems, 
specifically in Locale::Maketext::Guts::_compile

We started having occasional problems a couple of weeks ago. As of today, 
however, it's an epidemic, and nothing is working. I'm running freebsd, 
ports of everything, rt-3.0.11.

Flailing about, I tried replacing

my $sub = eval(join '', @code);
die "$@ while evalling" . join('', @code) if $@; # Should be impossible.

with

my($evalcode, $sub);
$sub = join('', @code);
{
  no locale;
  $sub=~ m/^(.*)/;
  $evalcode = $1;
  $sub = eval($evalcode);
  die "$@ while evalling $evalcode" if $@; # Should be impossible.
}

on the theory that the regex would untaint. In fact, that appears to have 
worked. Unfortunately, I still can't do anything. I've got taint errors at

error: 	Insecure dependency in mkdir while running with -T switch at 
/usr/local/lib/perl5/5.8.4/File/Path.pm line 159.
	
context: 	
... 		
155: 	unless (-d $parent or $path eq $parent) {	
156: 	push(@created,mkpath($parent, $verbose, $mode));	
157: 	}	
158: 	print "mkdir $path\n" if $verbose;	
159: 	unless (mkdir($path,$mode)) {	
160: 	my $e = $!;	
161: 	# allow for another process to have created it meanwhile	
162: 	croak "mkdir $path: $e" unless -d $path;	
163: 	}

when trying to load the main page, and, when attempting to create a ticket:

ror: 	Insecure dependency in require while running with -T switch at 
/usr/local/lib/perl5/site_perl/5.8.4/Apache/Session/Serialize/Storable.pm 
line 21
	
context: 	
... 		
187: 	# whether they should generate a full stack trace (confess() and 
cluck())	
188: 	# or simply report the caller's package (croak() and carp()), 
respectively.	
189: 	# confess() and croak() die, carp() and cluck() warn.	
190: 		
191: 	sub croak { die shortmess @_ }	
192: 	sub confess { die longmess @_ }	
193: 	sub carp { warn shortmess @_ }	
194: 	sub cluck { warn longmess @_ }	
195: 		
... 		
code stack: 	/usr/local/lib/perl5/5.8.4/Carp.pm:191
/usr/local/lib/perl5/5.8.4/AutoLoader.pm:112
/usr/local/lib/perl5/site_perl/5.8.4/Apache/Session/Serialize/Storable.pm:21
/usr/local/lib/perl5/site_perl/5.8.4/Apache/Session.pm:507
/usr/local/lib/perl5/site_perl/5.8.4/Apache/Session.pm:462
/usr/local/lib/perl5/site_perl/5.8.4/HTML/Mason/Request.pm:1078

Ummm... Help???? (Oh, I've cleared the mason-handler cache whilst 
restarting apache with each.)

--
Brent B. Powers
Manager, Information Technology
Department of Pathology
Columbia University