I've noticed that File::Find doesn't work under taint checks. Eg :- 
#!/usr/bin/perl -wT

use strict;
use File::Find;

$ENV{PATH} = "/bin:/usr/bin";
$ENV{ENV} = "";

# This produces "Insecure dependency in chdir while running with -T
# switch"
find( sub { print }, "." );

[download]
A bit of rooting about in the source code comes up with the problem - File::Find uses Cwd::cwd which produces tainted results. Eg:- 
#!/usr/bin/perl -wT

use strict;
use Cwd;

$ENV{PATH} = "/bin:/usr/bin";
$ENV{ENV} = "";

# This produces "Insecure dependency in system while running with -T
# switch"
system "ls " . cwd();

[download]
Now I can see that it might be advantageous for setuid scripts to think that cwd() returns tainted data, but unfortunately this means that is isn't possible to use File::Find with -T set because the call to Cwd is internal to File::Find and can't be monkeyed with.

Any ideas on how to get around this?

PS This may be a un*x only problem I don't know. I tested this with 5.005_03 on linux.

PPS The code for Cwd::cwd() looks like chop(`pwd`) which is rather unpleasant in my opinion because it is calling the shell which starts another process, takes time etc. (Remove the PATH in the Cwd example above and it will fail with can't find pwd!)

In reply to Taint checking, File::Find and Cwd by ncw

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.