in reply to Taint and Shellshock

I have an example of a piecemeal solution. This is the sort of thing that you are suggesting to prevent doing by setting up a localised environment?

Using File::Find I was having some warnings regarding insecure dependencies so I took to the debugger

I solved untainting of directory paths by localising the environment variables such as PATH,CDPATH,IFS and using the hash argument form of the find subroutine.

file( { wanted => \&wanted, untaint => 1 }, '.' );

[download]

However I continued to get insecure PATH dependancy warnings through debugger and its use of Term::Cap Using the perl debugger (-d switch) Term::Cap shells out and gives me warnings. I fixed this by assigning a literal path right before the eval.

Having localised the environment in my script, will I need to also localise for the debugger too? How do I do that?

code excerpt Term::Cap version 1.16 lines 239 - 275 Term::Cap meta-source lines 251-254 being of particular interest. my workaround being commented '# op fix'

    if ( !@termcap_path || !$entry )
    {
 
        # last resort--fake up a termcap from terminfo
        local $ENV{TERM} = $term;
 
        if ( $^O eq 'VMS' )
        {
            $entry = $VMS_TERMCAP;
        }
        else
        {
            if ( grep { -x "$_/infocmp" } split /:/, $ENV{PATH} )
            { 
 # op fix; $ENV{PATH} = "/usr/bin:...";
                eval { 
                    my $tmp = `infocmp -C 2>/dev/null`;
                    $tmp =~ s/^#.*\n//gm;    # remove comments
                    if (   ( $tmp !~ m%^/%s )
                        && ( $tmp =~ /(^|\|)${termpat}[:|]/s ) )
                    {
                        $entry = $tmp;
                    }
                };
                warn "Can't run infocmp to get a termcap entry: $@" if
+ $@;
            }
            else
            {
               # this is getting desperate now
               if ( $self->{TERM} eq 'dumb' )
               {
                  $entry = 'dumb|80-column dumb tty::am::co#80::bl=^G:
+cr=^M:do=^J:sf=^J:';
               }
            }
        }
    }
 
    croak "Can't find a valid termcap file" unless @termcap_path || $e
+ntry;

[download]
DoC enlightenment is the true goal
shellshock is a penalty shoot out

In Section Seekers of Perl Wisdom