From 4624f71ea2b8b2cfb50bbb46761934cb0a7d41e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Lesimple?=
 <stephane.lesimple+bastion@ovhcloud.com>
Date: Mon, 15 Feb 2021 11:17:55 +0000
Subject: [PATCH] fix: execute: remove osh_warn on tainted params to avoid
 exposing arguments on coding error

---
 lib/perl/OVH/Bastion/execute.inc | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/lib/perl/OVH/Bastion/execute.inc b/lib/perl/OVH/Bastion/execute.inc
index bacd3d8..d7af8bd 100644
--- a/lib/perl/OVH/Bastion/execute.inc
+++ b/lib/perl/OVH/Bastion/execute.inc
@@ -67,7 +67,6 @@ sub execute {
     }
 =cut
 
-    #=cut only to debug tainted stuff
     require Scalar::Util;
     foreach (@$cmd) {
         if (Scalar::Util::tainted($_) && /(.+)/) {
@@ -75,12 +74,9 @@ sub execute {
             # to be able to warn under -T; untaint it. we're going to crash right after anyway.
             require Carp;
             warn(Carp::longmess("would exec <" . join('^', @$cmd) . "> but param '$1' is tainted!"));
-            osh_warn("about to execute a cmd but param '$1' is tainted, I'm gonna crash!");
         }
     }
 
-    #=cut
-
     if ($system) {
         my $child_exit_status = system(@$cmd);
         $fnret = sysret2human($child_exit_status);