yep this works for me

D:\tmp\pm>type findbin_taint.pl
use strict;
use warnings;
use FindBin qw($RealBin);

my $my_lib;
BEGIN {
    $RealBin =~ m/(.+)/;                               # just a demo, 
+you should only accept a safe path
    $my_lib = "$1/../lib";
}


use lib $my_lib;
print join"\n",@INC;

use PadWalker;                                         # no matter wha
+t you use will fail if @INC has a tainted entry

D:\tmp\pm>perl -T findbin_taint.pl
D:/tmp/pm/../lib
C:/Strawberry/perl/site/lib/MSWin32-x64-multi-thread
C:/Strawberry/perl/site/lib
C:/Strawberry/perl/vendor/lib
C:/Strawberry/perl/lib
D:\tmp\pm>
[download]

yep this works for me

Thanks.

Based on the above I now have this:

#!/usr/bin/perl -T

use CGI::Carp qw(fatalsToBrowser);

use FindBin qw($RealBin);

my $safepath;
BEGIN {
    if ($RealBin =~ m!^(/home/username/website/uk/www)!) {
        $safepath = "$1/../lib";
    } else {
        die "Illegal use of software - visit www.website.uk to use thi
+s site";
    }
}
use lib "$RealBin/../lib";

use Site::HTML;    <-- line 17
[download]

This gives the same error Insecure dependency in require while running with -T switch at index.pl line 18. so I think I can safely assume that the problem is with the Site::HTML module.

Edit:

Whoops! Above I left it as use lib "$RealBin/../lib";
Changing it to use lib "$safepath"; works.

So, at least I know Site::HTML can be used with taint mode. Now to find where it doesn't function.

> so I think I can safely assume that the problem is with the Site::HTML module.

nope, try

use lib $safepath;

instead. :)

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery}