Re: testing script execs without taint mode on (-T)

I can not think of why taint mode would be needed in general for published Perl module tests. A spot check of a couple authors I find credible found one who did use taint mode (Andy Lester), and one who did not (Karen Etheridge).

Your script as posted fails to compile. Replacing $ascriptname with $infile fixes this and produces your error given a non-empty abc.pl

My suggestion is that, rather than appealing to "general practice" you determine whether you actually need taint mode. The taint mode section of perlsec is a good start.

If you find that you must use taint mode, my strong suspicion is that you will have to abandon Test::Script. On my system, the taint appears to come from a call that script_compiles() makes to File::Spec->rel2abs(), which calls Cwd::getcwd(), whose output is and must be tainted.

Comment on Re: testing script execs without taint mode on (-T) Select or Download Code

Replies are listed 'Best First'.
Re^2: testing script execs without taint mode on (-T) by bliako (Abbot) on Apr 18, 2020 at 16:18 UTC
Hm, I thought it as standard, since module-starter adds that to the shebang of each test file. Thanks for the advice, I will skip the taint mode on testing whether script executables compile and run. I will keep it on for testing the module itself just to be able to know where such taints occur and warn the user about.	[reply]