add extra language in the quotemeta() docs for embedded \ and $

[perl5.git] / taint.c

diff --git a/taint.c b/taint.c
index fab98ec..5834548 100644 (file)
--- a/taint.c
+++ b/taint.c
@@ -26,30 +26,26 @@
 void
 Perl_taint_proper(pTHX_ const char *f, const char *const s)
 {
-#if defined(HAS_SETEUID) && defined(DEBUGGING)
-    dVAR;
+    /* Output a tainting violation, croaking unless we're just to warn.
+     * '_proper' is just to throw you off the scent */
 
+#if defined(HAS_SETEUID) && defined(DEBUGGING)
     PERL_ARGS_ASSERT_TAINT_PROPER;
 
-#   if Uid_t_size == 1
     {
-       const UV  uid = PerlProc_getuid();
-       const UV euid = PerlProc_geteuid();
+       const Uid_t  uid = PerlProc_getuid();
+       const Uid_t euid = PerlProc_geteuid();
 
+#if Uid_t_sign == 1 /* uid_t is unsigned. */
        DEBUG_u(PerlIO_printf(Perl_debug_log,
-                              "%s %d %"UVuf" %"UVuf"\n",
-                              s, TAINT_get, uid, euid));
-    }
-#   else
-    {
-       const IV  uid = PerlProc_getuid();
-       const IV euid = PerlProc_geteuid();
-
+                              "%s %d %" UVuf " %" UVuf "\n",
+                              s, TAINT_get, (UV)uid, (UV)euid));
+#else /* uid_t is signed (Uid_t_sign == -1), or don't know. */
        DEBUG_u(PerlIO_printf(Perl_debug_log,
-                              "%s %d %"IVdf" %"IVdf"\n",
-                              s, TAINT_get, uid, euid));
+                              "%s %d %" IVdf " %" IVdf "\n",
+                              s, TAINT_get, (IV)uid, (IV)euid));
+#endif
     }
-#   endif
 #endif
 
     if (TAINT_get) {
@@ -65,21 +61,26 @@ Perl_taint_proper(pTHX_ const char *f, const char *const s)
             ug = " while running with -t switch";
         else
            ug = " while running with -T switch";
+
+        /* XXX because taint_proper adds extra format args, we can't
+         * get the caller to check properly; so we just silence the warning
+         * and hope the callers aren't naughty */
+        GCC_DIAG_IGNORE_STMT(-Wformat-nonliteral);
        if (PL_unsafe || TAINT_WARN_get) {
            Perl_ck_warner_d(aTHX_ packWARN(WARN_TAINT), f, s, ug);
         }
         else {
             Perl_croak(aTHX_ f, s, ug);
         }
+        GCC_DIAG_RESTORE_STMT;
+
     }
 }
 
 void
 Perl_taint_env(pTHX)
 {
-    dVAR;
     SV** svp;
-    MAGIC* mg;
     const char* const *e;
     static const char* const misc_env[] = {
        "IFS",          /* most shells' inter-field separators */
@@ -122,8 +123,9 @@ Perl_taint_env(pTHX)
     STRLEN len = 8; /* strlen(name)  */
 
     while (1) {
+        MAGIC* mg;
        if (i)
-           len = my_sprintf(name,"DCL$PATH;%d", i);
+           len = my_snprintf(name, sizeof name, "DCL$PATH;%d", i);
        svp = hv_fetch(GvHVn(PL_envgv), name, len, FALSE);
        if (!svp || *svp == &PL_sv_undef)
            break;
@@ -142,6 +144,7 @@ Perl_taint_env(pTHX)
 
     svp = hv_fetchs(GvHVn(PL_envgv),"PATH",FALSE);
     if (svp && *svp) {
+        MAGIC* mg;
        if (SvTAINTED(*svp)) {
            TAINT;
            taint_proper("Insecure %s%s", "$ENV{PATH}");
@@ -167,7 +170,7 @@ Perl_taint_env(pTHX)
 #endif
        if (t < e && isWORDCHAR(*t))
            t++;
-       while (t < e && (isWORDCHAR(*t) || strchr("-_.+", *t)))
+       while (t < e && (isWORDCHAR(*t) || memCHRs("-_.+", *t)))
            t++;
        if (t < e) {
            TAINT;
@@ -186,11 +189,5 @@ Perl_taint_env(pTHX)
 }
 
 /*
- * Local variables:
- * c-indentation-style: bsd
- * c-basic-offset: 4
- * indent-tabs-mode: nil
- * End:
- *
  * ex: set ts=8 sts=4 sw=4 et:
  */