Error connecting to hosts resolved from /etc/hosts

[José Micó]

When running with -T switch and AnyEvent::Socket tries to connect to a 
host which was resolved from /etc/hosts, it dies with error:

    Insecure dependency in connect while running with -T switch at
    /.../AnyEvent/Socket.pm line 1019.


This happens because the parsed $sockaddr remains tainted, so I patched 
Socket.pm making it untaint parsed addresses within 
AnyEvent::Socket::_parse_hosts() :

--- a/AnyEvent/Socket.pm
+++ b/AnyEvent/Socket.pm
@@ -662,9 +662,11 @@ sub _parse_hosts($) {
        next unless @aliases;
  
        if (my $ip = parse_ipv4 $addr) {
+         ($ip) = $ip =~ /^(.*)$/s if AnyEvent::TAINT;
           push @{ $HOSTS{$_}[0] }, $ip
              for @aliases;
        } elsif (my $ip = parse_ipv6 $addr) {
+         ($ip) = $ip =~ /^(.*)$/s if AnyEvent::TAINT;
           push @{ $HOSTS{$_}[1] }, $ip
              for @aliases;
        }


Regards,
José



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.schmorp.de/pipermail/anyevent/attachments/20130521/3701c23d/attachment.html>