in reply to why is this tainted?
# send password:
$ENV{"PATH"} = "";
open (MAIL, "| /usr/lib/sendmail $email");
http://www.perl.org/troubleshooting_CGI.html
--------------------------------------------------------
Is the script complaining about insecure dependencies?
If your script complains about insecure dependencies, you
are probably using the -T switch to turn on taint mode.
Any data originating from outside of the program (i.e. the enviroment) is considered tainted.
Environment variables such as PATH and LD_LIBRARY_PATH are particularly troublesome.
You have to set these to a safe value or unset them completely, as I recommend.
You should be using absolute paths anyway.
If taint checking complains about something else, make sure that you have untainted the data.
See the perlsec man page for details.
-ans
|
|---|