This is indeed unfortunate behavior of perlio.c and PerlIO, if not a bug - but also a questionable expectation.

It is not necessarily the case that reading from a tainted path causes an Insecure dependency. You can do that quite fine. Taint checking only kicks in if you want to use the tainted data you get from the file in a certain fashion, which the code doesn't. So I would expect that it just works even in taint mode.

A bit of digging reveals: Using Test::More makes a difference because Test::More loads PerlIO, but not PerlIO::encoding.

• Your argument list to open is tainted, but I have no idea how the tainted $whereami affects the string '<:encoding(UTF-8)'.
• PerlIO extracts the module to load (here: PerlIO::encoding) from your open parameter. Loading a tainted module name is fatal under -T, because unlike reading, it executes code. But it loads with eval, so that fatal error is caught, and converted it to a mere warning. I have not figured out where and how this warning is caught and converted to that strange message Unknown PerlIO layer "encoding".
• This does not happen, of course, if you have loaded PerlIO::encoding in advance!

If neither PerlIO nor PerlIO::encoding are loaded, then something in perlio.c seems to try to load PerlIO::encoding without the safeguard of an eval - and throws the Insecure dependency is thrown in your face.

I would expect that open in its three-argument-form would be able to treat encoding as not tainted even if the path is tainted, and hence consider this a bug.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.