X-Git-Url: https://git.dogcows.com/gitweb?a=blobdiff_plain;f=t%2F1_validate_14_untaint.t;h=98f9d217f1e758e4a85e46df36ab0c1662660a3a;hb=febed4ec71f803b083c3e61b82b9464e9bfb0992;hp=0af323b33494b6f9c0fb6085ef24c14650cf7031;hpb=4eee158dce82376f2f37de29d91c53f60a24aebe;p=chaz%2Fp5-CGI-Ex diff --git a/t/1_validate_14_untaint.t b/t/1_validate_14_untaint.t index 0af323b..98f9d21 100644 --- a/t/1_validate_14_untaint.t +++ b/t/1_validate_14_untaint.t @@ -10,13 +10,19 @@ use strict; use Test::More tests => 14; use FindBin qw($Bin); -use lib ($Bin =~ /(.+)/ ? "$1/../lib" : ''); # add bin - but untaint it +use lib ($Bin =~ /(.+)/ ? (-e "$1/../blib" ? "$1/../blib" : "$1/../lib") : ''); # add bin - but untaint it ### Set up taint checking -sub is_tainted { local $^W = 0; ! eval { eval("#" . substr(join("", @_), 0, 0)); 1; 0 } } +sub is_tainted { local $^W; eval { eval("#" . substr(join("", @_), 0, 0)); 1; } ? 0 : 1 } SKIP: { +my $ok = 1; +if (is_tainted($ok)) { + skip("is_tainted has false positives($@)", 14); +} + + my $taint = join(",", $0, %ENV, @ARGV); if (! is_tainted($taint) && open(my $fh, "/dev/urandom")) { sysread($fh, $taint, 1); @@ -28,10 +34,13 @@ if (! is_tainted($taint)) { ### make sure tainted hash values don't bleed into other values my $form = {}; +if (is_tainted($form)) { + skip("Tainted doesn't work", 14); +} $form->{'foo'} = "123$taint"; $form->{'bar'} = "456$taint"; $form->{'baz'} = "789"; -if (! is_tainted($form->{'foo'})) { +if (! is_tainted($form->{'foo'})) { skip("Tainted hash key didn't work right", 14); } elsif (is_tainted($form->{'baz'})) { # untaint checking doesn't really work