Re: Taint checking with Cwd();

You need to explicitly set your path to a known value when executing scripts under the -T (taint) switch. From perlsec ...

Cleaning Up Your Path

For ``Insecure $ENV{PATH}'' messages, you need to set $ENV{'PATH'} to a known value, and each directory in the path must be non-writable by others than its owner and group. You may be surprised to get this message even if the pathname to your executable is fully qualified. This is not generated because you didn't supply a full path to the program; instead, it's generated because you never set your PATH environment variable, or you didn't set it to something that was safe. Because Perl can't guarantee that the executable in question isn't itself going to turn around and execute some other program that is dependent on your PATH, it makes sure you set the PATH.

Ooohhh, Rob no beer function well without!

Comment on Re: Taint checking with Cwd();

Replies are listed 'Best First'.
Re: Re: Taint checking with Cwd(); by isaac32767 (Initiate) on Jan 21, 2004 at 05:13 UTC
An old thread, but one I found quite useful. And worth adding to: Rob_au's comments made me read perlsec in rather more detail than I had in the past. The perlsec for my version (5.6.1) said "see perlrun for its description of cleaning up environment variables." So I did, copied a certain code snippet into my own script. And behold! End of taint errors.	[reply]