Re^4: File::Temp::tempfile() fails under taint mode

Yes, it fails for me in Strawberry Perl 5.18.2 also. Seems it was a known issue which was previously marked as “resolved,” so I have filed a bug report accordingly:

https://rt.cpan.org/Public/Bug/Display.html?id=103452

Thanks to you and to Discipulus for the valuable feedback.

Athanasius <°(((>< contra mundum Iustus alius egestas vitae, eros Piratica,

Comment on Re^4: File::Temp::tempfile() fails under taint mode

Replies are listed 'Best First'.
Re^5: File::Temp::tempfile() fails under taint mode by Anonymous Monk on Apr 11, 2015 at 10:15 UTC
This error currently causes installation failure for modules MooseX-App-Cmd-0.30, Dancer-1.3134, and probably others. That is never a convincing argument (it breaks some other modules test) OTOH, this particular bug is so old and stupid, the docs got updated (tmpdir of File::Spec::Win32) to warn about it and disagree with the spec (tmpdir of File::Spec) So the bugs as I see them in File::Spec are The last ditch directory is supposed to be the current directory ( File::Spec->curdir ) not / or /tmp / is a stupid directory to include / hardcode in the list either taint everything, including the hard coded values , or untaint all the paths -- hybrid approach is stupid and inconvenient -- either you're helping/convenient/untainting, or you're letting the user deal with it The bugs in File::Temp are it lets File::Spec get away with being stupid when it knows how stupid it is :) if it doesn't deal with the tainting its useless either do the job of tmpdir only better, or croak warning the user to ~~untaint %ENV manually~~ supply an untainted tmpdir manually (api change) Current situation is inconveniencing everyone who tries to use either or both of these modules FWIW, these are all variation of the same bug (not doing what the "spec" says, and the spec being ~~stupid~~ old/vague/akward/not useful ) Bug #76663 for PathTools: ->tmpdir on MSWin32 often returns the root-dir Bug #70492 for PathTools: Re: Bug #60406 for PathTools: tmpdir with -T on Windows Bug #60406 for PathTools: tmpdir with -T on Windows Bug #29015 for PathTools: tmpdir() on Cygwin needs filetest pragma Bug #74349 for PathTools: TMPDIR is being cached for the life of the module update: Oh look some discussion on this Bug #120593 for perl5: File::Spec::Unix->tmpdir: Always return an absolute path the arguments seem very weak and unconvincing	[reply]

Replies are listed 'Best First'.

Re^5: File::Temp::tempfile() fails under taint mode
by Anonymous Monk on Apr 11, 2015 at 10:15 UTC

This error currently causes installation failure for modules MooseX-App-Cmd-0.30, Dancer-1.3134, and probably others.

That is never a convincing argument (it breaks some other modules test)

OTOH, this particular bug is so old and stupid, the docs got updated (tmpdir of File::Spec::Win32) to warn about it and disagree with the spec (tmpdir of File::Spec)

So the bugs as I see them in File::Spec are

The last ditch directory is supposed to be the current directory ( File::Spec->curdir ) not / or /tmp
/ is a stupid directory to include / hardcode in the list
either taint everything, including the hard coded values ,
or untaint all the paths -- hybrid approach is stupid and inconvenient -- either you're helping/convenient/untainting, or you're letting the user deal with it

The bugs in File::Temp are

it lets File::Spec get away with being stupid when it knows how stupid it is :) if it doesn't deal with the tainting its useless
either do the job of tmpdir only better,
or croak warning the user to ~~untaint %ENV manually~~ supply an untainted tmpdir manually (api change)

Current situation is inconveniencing everyone who tries to use either or both of these modules

FWIW, these are all variation of the same bug (not doing what the "spec" says, and the spec being ~~stupid~~ old/vague/akward/not useful )
Bug #76663 for PathTools: ->tmpdir on MSWin32 often returns the root-dir
Bug #70492 for PathTools: Re: Bug #60406 for PathTools: tmpdir with -T on Windows
Bug #60406 for PathTools: tmpdir with -T on Windows
Bug #29015 for PathTools: tmpdir() on Cygwin needs filetest pragma
Bug #74349 for PathTools: TMPDIR is being cached for the life of the module

update: Oh look some discussion on this Bug #120593 for perl5: File::Spec::Unix->tmpdir: Always return an absolute path

the arguments seem very weak and unconvincing

[reply]