$ perl -I. -Tle "use retaint; retaint::foo(); print 123; print substr $ENV{PATH}, 0, 1; " retaint.pm:20: tainted? 1 retaint.pm:21: tainted? 0 123 D $ perl -I. -Tle "use taintall; use retaint; retaint::foo(); print 123; print substr $ENV{PATH}, 0, 1; " /loader/0xb61cbc/retaint.pm:21: tainted? 1 /loader/0xb61cbc/retaint.pm:22: tainted? 1 123 Insecure dependency in 'print' at -e line 1. #### package taintall; use strict; use re (); use Module::Util(); use File::Temp(); use Tie::STDOUT print => sub { use Carp; use Taint::Util(); croak( "Insecure dependency in 'print'" ) if grep { Taint::Util::tainted( $_ ) } @_; print @_; }, ;;;;; $Carp::Internal{ ( 'Tie::STDOUT' ) }++; unshift @INC, sub { my( $thiscoderef, $filename ) = @_; my $package = Module::Util::fs_path_to_module( $filename ); my $fullpath = Module::Util::find_installed( $package ); ## tempfile because of #~ https://rt.perl.org/rt3//Public/Bug/Display.html?id=96008# #96008: use and require are affected by the open pragma #~ https://rt.perl.org/rt3//Public/Bug/Display.html?id=75722# #75722: Recursive call to Perl_load_module in PerlIO_find_layer my( $tempFh, $tempFilename ) = File::Temp::tempfile(); return if not $fullpath or not $tempFilename; binmode $tempFh; print $tempFh "use re 'taint'; "; #line 0 { open my( $fh ), '<', $fullpath or die "Can't read ($fullpath): $!\n$^E\n "; binmode $fh; print $tempFh readline $fh; close $fh; } seek $tempFh, 0, 0; return $tempFh; };;;;; sub import { re->import( 'taint' ); } 1; #### package retaint; use strict; use warnings; use Taint::Util; sub ut { taint(my $sv = "hlagh"); $sv = $1 if $sv =~ /^(.*)/; $sv; } sub tt { taint(my $sv = "hlagh"); $sv; } sub f{ my ($package, $filename, $line ) = caller; printf qq/%s:%d: tainted? %d\n/, $filename, $line, int tainted $_[0]; } sub foo { f( tt() ); f( ut() ); } 1;