hy

s/hy/hv/g; # :)

Same failure.

Ah well, it was worth a try. (I had not appreciated that the sample fail was on Linux, I had imagined more esoteric systems.)

I've looked at more code, and am not seeing any obvious opportunities to get tainted results.

I could just about imagine getting taint interaction from rand() - at least, I know that some systems provide device sources of randomness, which would involve interacting with the filesystem. I'm not aware of any way to configure perl to use those directly with rand() though, and I don't see anything in perl source that would touch a filesystem or environment variables if the standard pp_rand() gets called. I can't rule out something replacing pp_rand in PL_ppaddr[] though.

All I can really suggest is to get more instrumentation by shipping a copy of (some version of) File::Temp::tempdir() (and/or a monkey-patched File::Temp::_gettemp()) with checks at various points that $path is touched.

I see that Scalar::Util provides tainted() at least as far back as the version shipped with perl-5.8, so that's probably a reasonable way to check.

The other option would be to contact BINGOS and ask if he could investigate, or give you access to one of the affected systems. And - long shot - it would also be interesting to check if there are any other modules that both use <c>tempdir() and test its behaviour under tainting that have also been tested by the same smokers.

In reply to Re^5: Insecure dependency in mkdir while running with -T switch at ... File/Temp.pm line 542 by hv
in thread Insecure dependency in mkdir while running with -T switch at ... File/Temp.pm line 542 by sidney

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.