in reply to eval $fh while setuid...
So, this code is reading in tainted data, and then trying to eval it. That's possibly very dangerous, so Perl doesn't let you do it.Insecure dependency in %s (F) You tried to do something that the tainting mechanism didn't like. The tainting mechanism is turned on when you're running setuid or setgid, or when you specify -T to turn it on explicitly. The tainting mechanism labels all data that's derived directly or indirectly from the user, who is considered to be unworthy of your trust. If any such data is used in a "dangerous" operation, you get this error. See the perlsec manpage for more information.
I'm not sure whether this is module is something you've written... If you really want to stick with the eval approach, you can untaint the data before you eval it. (See perlsec for how to untaint data.)
However, it would be better if this config file were stored in a way that didn't require being evaled. For example, it could use one of the config modules from CPAN.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: eval $fh while setuid...
by PsychoSpunk (Hermit) on Aug 04, 2001 at 00:17 UTC |