"The principle is simple: you may not use data derived outside your program to affect something else outside your program - at least, not by accident. Anything that comes from outside your program is marked as tainted, including all command-line arguments, environment variables, and file input. Tainted data may not be used directly or indirectly in any operation that involves a subshell, nor in any operation that modifies files, directories, or processes."
"If you aren't executing your CGI scripts under taint mode, you've needlessly abandoned the strongest protection Perl can give you. "
#!/usr/bin/perl -T
$a = 3; # untainted
$b = $ENV{HTTP_REFERRER} # tainted - comes from outside this code
$line = <STDIN> # tainted
$c = $b . $a; # tainted because $b is tainted
$d = `ls`; # FATAL ERROR - "ls" depends on PATH,
# which comes from outside the program.
#!/usr/bin/perl -T
$word = <STDIN> # tainted
# only keep this word if it is made up of only word characters
if ($line =~ /^([\w]+)$/) { $string = $1 } # now its untainted
else { die "non word char in string" }
From apache.org:
Allowing users to execute CGI scripts in any directory should only be considered if:
1.You trust your users not to write scripts which will deliberately or accidentally expose your system to an attack.
2.You consider security at your site to be so feeble in other areas, as to make one more potential hole irrelevant.
3.You have no users, and nobody ever visits your server.