| Subject: | SvPOK call is not correct |
| Date: | Wed, 3 Sep 2014 13:12:45 -0700 |
| To: | bug-Crypt-Skip32-XS [...] rt.cpan.org |
| From: | Aran Deltac <bluefeet [...] gmail.com> |
I recently installed Crypt::Skip32::XS and it started failing with the
error at this line:
if (! SvPOK(key)) {
my_croak("key must be an untainted string scalar");
}
I'm not an XS expert, but I've been banging my head on this for a couple
hours and my research has found that SvPOK does not mean "untaunted string
scalar". All it is is a flag that means the character data may be accessed
in the SvPVX value. That's all. Yes, untainted strings often end up in
SvPVX but that is not always the case.
Here's a reproducible example (make sure Crypt::Skip32::XS is installed):
perl -MCrypt::Skip32 -e '$k='abcdefghij'; $k=~m{^(.+)$};
Crypt::Skip32->new( $1 )'
Which then produces:
key must be an untainted string scalar at -e line 1.
But if I quote $1:
perl -MCrypt::Skip32 -e '$k='abcdefghij'; $k=~m{^(.+)$};
Crypt::Skip32->new( "$1" )'
There are no errors as quoting the $1 re-creates the scalar. This is an
example of a variable that is not tainted, and is a string scalar, but
fails for SvPOK. There are other ways to get the same situation, not just
with regex captures.
Aran