DBI security tainting
By default DBI ignores Perl tainting
- doesn't taint database data returned ‘out’ of the DBI
- doesn't check that parameters passed ‘in’ to the DBI are not tainted
-
The TaintIn and TaintOut attributes enable those behaviours
- If Perl itself is in taint mode.
-
Each handle has it's own inherited tainting attributes
- So can be enabled for particular connections and disabled for particular statements, for example:
$dbh = DBI->connect(…, { Taint => 1 }); # enable TaintIn and TaintOut
$sth = $dbh->prepare("select * from safe_table");
$sth->{TaintOut} = 0; # don’t taint data from this statement handle
Attribute metadata currently varies in degree of tainting
$sth->{NAME}; — generally not tainted
$dbh->get_info(…); — may be tainted if the item of info is fetched from database