From: patrick-may@... (Patrick May)
Date: 2002-11-22T22:37:30+09:00
Subject: Re: untainted, unfrozen, honest-to-god session data!

> Ah, I meant "external" as data read from the file.  Session data is
> published to the file, then read from the file.

Double ah.  One of the things Tom and I discovered about a "web"
enviroment is that much of what a CGI library provides should be
treated like the Kernel module, like a Web::Kernel.  We were thinking
about IO behaviour (:puts should send things to the browser, etc.),
but I also think it applies to this sort of thing, where "external"
means something different.

I guess I should ensure that Narf's Web::Session untaints from the
files it wrote, since that cooresponds to what the web programmer
would consider "external".

I wonder what other surprises are tucked away in this problem?

:-)

~ Patrick