Hello my friends,

My hostīs server was recently upgraded to Debian Sarge and, with it, to Perl 5.8 as well. I was very happy untill I realized all my email-generating scripts stopped working right away, with the following error each time I tried to send out an email: 

Software error:
Insecure $ENV{PATH} while running with -T switch at
/usr/share/perl5/MIME/Lite.pm line 2571.
1
Content-type: text/html
Software error:
error closing /usr/lib/sendmail:  (exit 65280)
1

[download]
The script is basically a contact.cgi, with this code for the emailing: 
use MIME::Lite;
MIME::Lite->send("sendmail");

# ... variables definition here

my $msg = MIME::Lite->new( 
   
                           To      => "$emailsite",
                           From    => "$from",
                           Subject => "Contato >> $assunto",
                           Type    => 'text/html',
                           Data    => "$html" );

$msg->send(); # This call triggers the error. If I comment it out ther
+eīs no error message. But thereīs no email too...

[download]

Sure, itīs a taint mode issue, and I heard Perl got more rigid about taintedness from 5.6 to 5.8. But the strange thing is that none of the following steps seem to do any help:

1) Checking for taintedness of all the variables that go into the MIME::Lite->new() method. None of them is tainted. By the way, i used this code to check each one of them: 

if ( is_tainted($variable) ) { die "tainted"; } else { die "not tainte
+d"; }

sub is_tainted {
   return ! eval { 
      join('',@_), kill 0; 
      1;     
   };
}

[download]
2) Checking for taintedness the $msg variable. Not tainted.
2) Setting the $ENV{'PATH'} from inside the script, with $ENV{'PATH'} = "/usr/local/bin:/usr/bin:/bin"; This one also doesnīt solve, but just changes the problem. The message becomes: 
Software error:
Insecure dependency in exec while running with -T switch at /usr/share
+/perl5/MIME/Lite.pm line 2571.
1 
Content-type: text/html 
Software error:
error closing /usr/lib/sendmail:  (exit 65280)
1

[download]

Any ideas? Iīm clueless here.

Thanks

Andre_br
UPDATE: I also tried the delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; described in the perlsec, but still got the same error.

UPDATE2: I also checked my host's directories /usr/local/bin:/usr/bin:/bin and they are also not-world-writtable, as perlsecs recomends.

In reply to Taint mode trap from Perl 5.6 to 5.8 by Andre_br

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.