From a users perspective, it is a good thing to know that the test script is not going to do anything odd with your personel system/data.

That's not what taint mode does, though -- it flags external data, not internal data. A test script could very well do this evil thing:

WARNING -- Don't try this at home.

#!/usr/bin/perl -T

#### DO NOT ACTUALLY RUN THIS CODE ####

use Test::More tests => 1;
use File::Path;
use File::Spec;

my $n = rmtree( File::Spec->rootdir(), 0, 1);

ok( $n, "Deleted at least one file from the root directory" );

[download]

Sadly, Perl doesn't have a nice sandbox like Java. Good reason not build/test modules as root, eh?

What the taint flag will do is limit the directories in @INC. From perlsec:

When the taint mode ("-T") is in effect, the "." directory is removed from @INC, and the environment variables "PERL5LIB" and "PERLLIB" are ignored by Perl. You can still adjust @INC from outside the program by using the "-I" command line option as explained in perlrun. The two environment variables are ignored because they are obscured, and a user running a program could be unaware that they are set, whereas the "-I" option is clearly visible and therefore permitted.

For testing, I'm still not sure if that is or isn't desireable. What if a user has their own private installation in PERL5LIB?

-xdg

Code written by xdg and posted on PerlMonks is public domain. It is provided as is with no warranties, express or implied, of any kind. Posted code may not have been tested. Use of posted code is at your own risk.

In reply to Re^2: Why a taint flag on test files? by xdg
in thread Why a taint flag on test files? by xdg

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.