There is probably code somewhere that takes advantage of that fact, and under 5.10.0 that code is now less secure.
So, someone, somewhere might be unpacking a tainted string and relying upon the resultants continued tainted status to prevent them from ... ?
I agree that departure from the documented behaviour is not good, but I would be a little leary about labelling it as a "security risk".
In reply to Re^5: pack() untaints data : bug or undocumented Perl 5.10 feature?
by BrowserUk
in thread pack() untaints data : bug or undocumented Perl 5.10 feature?
by mr_mischief
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |