My specification included (and requires) registering untaint handling callbacks with the CGI::Paranoia object on creation. This is the application's opportunity to say what is tainted and what not.

Also in the case of functuons like self_url(), the application is not well placed to say what is tainted. The application is well placed to test each parameter for taint, but to test the result of self_url() for taint it has to parse an http address. The CGI module is better placed to do this albeit deferring to the application when it is reduced down to individual parameters.

I clearly need to knock up a simple example, which I will endeavour to do before someone else posts.

Update

I have an example. First of all the template file "test.tmpl". 
<html>
  <head><title>test.tmpl</title></head>
  <body>
    <TMPL_VAR NAME="form">
      <submit/>
    </form>
  </body>
</html>

[download]
Now the test script: test.pl. 
#!/usr/bin/perl -wT
use HTML::Template;
use CGI;
my $q = CGI->new();
my $template = HTML::Template->new(filename => './test.tmpl',force_unt
+aint=>1);
$template->param(form=>$q->start_form());
print $template->output();

[download]
The output is as follows: 
$> perl -T test.pl
<html>
  <head><title>test.tmpl</title></head>
  <body>
    <form method="post" action="http://localhost" enctype="multipart/f
+orm-data">


      <submit/>
    </form>
  </body>
</html>

$> perl -T test.pl blah=1
HTML::Template->output() : tainted value with 'force_untaint' option a
+t test.pl
line 7

[download]
I think the CGI module is better placed to produce an untainted start_form() value then the application.

In reply to Re^2: CGI::Paranoia - Re^4: Is the force_untaint option in HTML::Template overkill? by SilasTheMonk
in thread Is the force_untaint option in HTML::Template overkill? by SilasTheMonk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.