dissident has asked for the wisdom of the Perl Monks concerning the following question:

The perlsec section about Taint mode (https://perldoc.perl.org/perlsec#Taint-mode) begins with a statement
"By default, Perl automatically enables a set of special security checks, called taint mode".

So the question arises:
How to completely turn off these default-enabled "special security checks" which are enabled even without the -T option?
Or: How to completely disable the said "taint mode"?

There are several legit reasons to do so:
- To find out quickly whether these "security checks" are what causes your script to not work.
- When not needed at all in the given scenario.
- To make Perl more efficient, runtime-wise and energy-wise.
   These checks adds a runtime overhead of ~10% (see https://blogs.perl.org/users/neilb/2021/08/making-taint-support-optional-in-perl.html)
   Thus, in many scenarios this checking is not only utterly unnecessary, but actually detrimental.

Replies are listed 'Best First'.
Re: How to disable taint checking by Perl?
by Corion (Patriarch) on Oct 09, 2023 at 10:56 UTC

    The sentence continues:

    ... when it detects its program running with differing real and effective user or group IDs.

    So, the easiest way would be to run Perl with the same real and effective user id.

    You can rebuild your Perl from source and use the build flags for (disabling) Taint Support.

[reply]
Re: How to disable taint checking by Perl?
by Polyglot (Chaplain) on Oct 25, 2023 at 00:00 UTC
    It seems the creators of the Mojolicious package have found some way to entirely disable taint checks. Deep within their documentation they say:

    Is Perl's taint mode supported by Mojolicious?

    No. There is no benefit at all to using taint mode. Modern Perl applications are much too complex to benefit from such a naive mechanism in any meaningful way. At best it would give you a false sense of security.

    See more here: https://docs.mojolicious.org/Mojolicious/Guides/FAQ

    Blessings,

    ~Polyglot~

[reply]
      It seems the creators of the Mojolicious package have found some way to entirely disable taint checks
      They say they don't support it, where is it disabled?
[reply]
        The language they employ to disavow any association with 'taint' seems to indicate they disabled it, because their package is supported by the latest two releases of Perl, which, if I am not mistaken, typically enforce taint without it being explicitly called.

        Blessings,

        ~Polyglot~

[reply]

Back to Seekers of Perl Wisdom