in reply to Re: Debugging a module that's failing under taint mode
in thread Debugging a module that's failing under taint mode

> I think you need to untaint $RealBin before adding it to lib.

yep this works for me

D:\tmp\pm>type findbin_taint.pl
use strict;
use warnings;
use FindBin qw($RealBin);

my $my_lib;
BEGIN {
    $RealBin =~ m/(.+)/;                               # just a demo, 
+you should only accept a safe path
    $my_lib = "$1/../lib";
}


use lib $my_lib;
print join"\n",@INC;

use PadWalker;                                         # no matter wha
+t you use will fail if @INC has a tainted entry

D:\tmp\pm>perl -T findbin_taint.pl
D:/tmp/pm/../lib
C:/Strawberry/perl/site/lib/MSWin32-x64-multi-thread
C:/Strawberry/perl/site/lib
C:/Strawberry/perl/vendor/lib
C:/Strawberry/perl/lib
D:\tmp\pm>

[download]

Cheers Rolf
(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery

Replies are listed 'Best First'.
Re^3: Debugging a module that's failing under taint mode
by Bod (Parson) on Jul 01, 2021 at 22:33 UTC
    yep this works for me

    Thanks.

    Based on the above I now have this: 

    #!/usr/bin/perl -T

use CGI::Carp qw(fatalsToBrowser);

use FindBin qw($RealBin);

my $safepath;
BEGIN {
    if ($RealBin =~ m!^(/home/username/website/uk/www)!) {
        $safepath = "$1/../lib";
    } else {
        die "Illegal use of software - visit www.website.uk to use thi
+s site";
    }
}
use lib "$RealBin/../lib";

use Site::HTML;    <-- line 17

    [download]
    This gives the same error Insecure dependency in require while running with -T switch at index.pl line 18. so I think I can safely assume that the problem is with the Site::HTML module.

    Edit:

    Whoops! Above I left it as use lib "$RealBin/../lib";
    Changing it to use lib "$safepath"; works.

    So, at least I know Site::HTML can be used with taint mode. Now to find where it doesn't function.

[reply]
[d/l]
[select]
      > so I think I can safely assume that the problem is with the Site::HTML module.

      nope, try

      use lib $safepath;

      instead. :)

      Cheers Rolf
      (addicted to the Perl Programming Language :)
      Wikisyntax for the Monastery

[reply]
[d/l]
[select]
        nope, try...

        Well spotted!
        I was editing my post as you typed that as I had spotted it too...

        Thanks for your help LanX

[reply]

In Section Seekers of Perl Wisdom