"Insecure dependency error while running with -T switch" using cicindela2

Question

I am applying the cicindela2 recommendation engine

It uses Apache mod_perl and the Perl DBI module.

Here is the rough flow of how it works

• Data input by Record Handler

• Data is passed through the filter chain for batch processing

• Temporary tables are output from batch processing

• Recommendation result is requested by accessing the Recommend Handler which trigger the action of Recommender

I configured an aggregation and ran the project batch script. I know that the batch processing succeeded because I saw the output of processing from DB. But when I tried to access the recommendation result with URL that triggers the Recommend Handler, I saw a blank white page and the log said

FATAL: Insecure dependency in parameter 1 of DBIx::ContextualFetch::db=HASH(0x7f2a76169e78)->prepare_cached method call while running with -T switch at /usr/local/share/perl5/Ima/DBI.pm line 398.

This is where the error was thrown from the Ima::DBI base module

/usr/local/share/perl5/Ima/DBI.pm.

sub _mk_sql_closure {

    my ($class, $sql_name, $statement, $db_meth, $cache) = @_;

    return sub {
        my $class = shift;
        my $dbh   = $class->$db_meth();

        # Everything must pass through sprintf, even if @_ is empty.
        # This is to do proper '%%' translation.

        my $sql = $class->transform_sql($statement => @_);

        return $cache    # Line 398
            ? $dbh->prepare_cached($sql)
            : $dbh->prepare($sql);
    };
}

It seems that the SQL query prepared by the program is insecure, right?

What is reason for this error?

Is it related to the function of cache management of DBI?

Would it be solved if I clear the cache regularly?

Also, I tried to log the SQL statement generated, but the output failed even when I placed something like $LOGGER->warn("123") in the handle subroutine of the Recommend Handler.

How come the log failed and how to log it correctly?

Answer 1

Insecure dependency... while running with -T switch is Perl's way of telling you that you're running with taint mode active and attempting to do something with tainted data which could be potentially unsafe. In this particular case, $sql is tainted, because some or all of its content came from sources external to the program - probably user input, although it could also have been read from a file.

To fix this, you need to think about where $sql came from, so that you can work out the appropriate way to clean it up.

In the most likely scenario, you've asked a user to supply search terms and then inserted those terms directly into your SQL string. This is a bad idea in general, as it opens you up to the possibility of SQL injection attacks. (Obligatory Bobby Tables link.) Revise your SQL handling to make use of SQL placeholders instead of inserting user input into the WHERE clause and this vulnerability should go away.

If tainted data is making its way into $sql in some other way, you need to clean up the tainted data by using a regular expression to validate it and capture the validated data, then assign the captured data to your variable. e.g.,

my $tainted = <STDIN>;
$tainted =~ /([A-Z]*)/; # Only allow uppercase characters
my $clean = $1;  # No longer tainted because it came from $1

If you need to take this route, DO NOT use .* as your regex to untaint the data without serious, serious consideration, because, if you just blindly accept any and all data, you will be discarding any and all benefit provided by taint mode.