Re: FindBin and Tainted

You can apply the usual untainting mantra by also using a BEGIN section:

use strict;
use warnings;
use FindBin 1.51 qw( $RealBin );
BEGIN {
    ($RealBin) = $RealBin =~ /(.+)/;
}
use lib "$RealBin/../lib";

use MyLib;
[download]

Of course, you need to trust your installation to not mess with the current working directory (because this is why $RealBin comes out tainted in the first place).

Comment on Re: FindBin and Tainted Download Code

Replies are listed 'Best First'.
Re^2: FindBin and Tainted by mikkoi (Beadle) on Aug 14, 2020 at 23:57 UTC
This works. But is there any way to do the same without using the same $RealBin variable (which belongs to FindBin)?	[reply]
Re^3: FindBin and Tainted by haj (Vicar) on Aug 15, 2020 at 08:55 UTC
Sure, you can use a copy, to be declared outside of the `BEGIN` block: `use strict; use warnings; use FindBin 1.51 qw( $RealBin ); my $untainted_bin; BEGIN { ($untainted_bin) = $RealBin =~ /(.+)/; } use lib "$untainted_bin/../lib"; use MyLib;` [download]	[reply] [d/l]
Re^4: FindBin and Tainted by mikkoi (Beadle) on Aug 15, 2020 at 20:18 UTC
Thanks. This is beautiful. I improved it a little. Probably more portable with `File::Spec`. `use FindBin 1.51 qw( $RealBin ); use File::Spec; my $lib_path; BEGIN { $lib_path = File::Spec->catdir(($RealBin =~ /(.+)/msx)[0], q{..}, +'lib'); } use lib "$lib_path";` [download]	[reply] [d/l] [select]