I have an example of a piecemeal solution. This is the sort of thing that you are suggesting to prevent doing by setting up a localised environment?

Using File::Find I was having some warnings regarding insecure dependencies so I took to the debugger

I solved untainting of directory paths by localising the environment variables such as PATH,CDPATH,IFS and using the hash argument form of the find subroutine.

file( { wanted => \&wanted, untaint => 1 }, '.' );

[download]

However I continued to get insecure PATH dependancy warnings through debugger and its use of Term::Cap Using the perl debugger (-d switch) Term::Cap shells out and gives me warnings. I fixed this by assigning a literal path right before the eval.

Having localised the environment in my script, will I need to also localise for the debugger too? How do I do that?

code excerpt Term::Cap version 1.16 lines 239 - 275 Term::Cap meta-source lines 251-254 being of particular interest. my workaround being commented '# op fix'

    if ( !@termcap_path || !$entry )
    {
 
        # last resort--fake up a termcap from terminfo
        local $ENV{TERM} = $term;
 
        if ( $^O eq 'VMS' )
        {
            $entry = $VMS_TERMCAP;
        }
        else
        {
            if ( grep { -x "$_/infocmp" } split /:/, $ENV{PATH} )
            { 
 # op fix; $ENV{PATH} = "/usr/bin:...";
                eval { 
                    my $tmp = `infocmp -C 2>/dev/null`;
                    $tmp =~ s/^#.*\n//gm;    # remove comments
                    if (   ( $tmp !~ m%^/%s )
                        && ( $tmp =~ /(^|\|)${termpat}[:|]/s ) )
                    {
                        $entry = $tmp;
                    }
                };
                warn "Can't run infocmp to get a termcap entry: $@" if
+ $@;
            }
            else
            {
               # this is getting desperate now
               if ( $self->{TERM} eq 'dumb' )
               {
                  $entry = 'dumb|80-column dumb tty::am::co#80::bl=^G:
+cr=^M:do=^J:sf=^J:';
               }
            }
        }
    }
 
    croak "Can't find a valid termcap file" unless @termcap_path || $e
+ntry;

[download]
DoC enlightenment is the true goal
shellshock is a penalty shoot out

In reply to Re: Taint and Shellshock by Don Coyote
in thread Taint and Shellshock by kennethk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.