Hi,
When untaint_all_constraints is used, D::F::Results reports an
invalid field as valid. The content is the last successful regexp
match, which may be absolutely unrelated to DFV. I reproduced
the bug with the attached script using Perl 5.12.1 and DFV 4.66 on
a Debian Lenny system.
I believe the problem is in line 809 of D::F::Results:
my ($match) = scalar ($val =~ $re);
if ($untaint_this && defined $match) {
# pass the value through a RE that matches anything to untaint it.
my ($untainted) = ($& =~ m/(.*)/s);
return $untainted;
}
The "scalar" has been added between 4.61 and 4.66. Even if $re
does not match, the scalar returns a defined value, which leads
into an old $& being used.
Cheers,
Dennis
| Subject: | dfvbug.pl |
#!/opt/perl/5.12/bin/perl
use strict;
use warnings;
use Data::FormValidator;
"some_unrelated_string" =~ m/^.*$/;
my $profile = {
untaint_all_constraints => 1,
required => [qw(a)],
constraint_methods => {
a => qr/will_never_match/,
},
};
my $results = Data::FormValidator->check({ a => 1 }, $profile);
warn $results->valid('a');