...
| Code Block | ||||
|---|---|---|---|---|
| ||||
sub validate_password {
my ($password) = @_;
my $is_ok = ($password eq "goodpass");
print "$prompt: Password ok? $is_ok\n";
return $is_ok;
};
# ...
|
Risk Assessment
Recommendation | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
IDS30-PL | high | probable | low | P18 | L1 |
Automated Detection
Perl's taint mode provides partial detection of unsanitized input in format strings.
Perl's warnings can detect if a call to printf() or sprintf() contains the wrong number of format string arguments.
Tool | Diagnostic |
|---|---|
Warnings | Missing argument in .*printf |
| Taint mode | Insecure dependency in .*printf |
| Security Reviewer - Static Reviewer | PERL_D90 |
Related Guidelines
Bibliography
| [Christey 2005] | Format string vulnerabilities in Perl programs |
|---|---|
| [Seacord 2005] | Chapter 6, "Formatted Output" |
| [VU#948385] | Perl contains an integer sign error in format string processing |
| [Wall 2011] | perlfunc |
...
...