in reply to Re: Re: Re: Re: no PerlIO $ENV{TAINTED};
in thread Perl 5.8.0 PerlIO insecure dependency

Thank you again folks for your feedback; however, I am looking for a solution that does not modify Perl 5.8.x. I don't want to support a custom patch against the core product. My guess is that this is something that the folks working on the core product are going to have to repair, and for now I'm stuck with "#!/bin/perl -U". Thanks again for your help! Peace.
  • Comment on Re: Re: Re: Re: Re: no PerlIO $ENV{TAINTED};

Replies are listed 'Best First'.
Re: Re: Re: Re: Re: Re: no PerlIO $ENV{TAINTED};
by PodMaster (Abbot) on Apr 13, 2004 at 12:40 UTC
    So you're saying you haven't tracked down where the tainted value is coming from? If you do that, and its not coming from a core module, you don't have to modify any core module :) so it pays to do it.

    MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
    I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
    ** The third rule of perl club is a statement of fact: pod is sexy.

[reply]
      Hmm... you are right. There may be an issue inside the XML::SAX implementation. I'll dig a little. Thanks.
[reply]
        Folks, just an update on my insecure dependency in PerlIO.pm issue. Here is the root cause. I've opened a ticket with rt.cpan.org. Thanks again for your help!! The root of the problem lies with XML::SAX::PurePerl. Installing XML::SAX::Expat caused the problem to go away. Again, this issue only appears when uid != euid. Code that fails: 
        #!/bin/perl

use XML::Filter::BufferText;
use XML::SAX::PurePerl;

use Carp;
$SIG{__DIE__} = \&Carp::confess;

my $filter = XML::Filter::BufferText->new();
my $parser = XML::SAX::PurePerl->new(Handler => $filter);

$parser->parse_file(\*STDIN);

Back trace from Carp::confess:

Insecure dependency in eval while running setuid at /opt/perl58/lib/5.
+8.0/PerlIO.pm line 22.
        PerlIO::import('PerlIO','encoding') called at /opt/perl58/lib/
+site_perl/5.8.0/XML/SAX/PurePerl/Reader/UnicodeExt.pm line 16
        XML::SAX::PurePerl::Reader::BEGIN() called at /opt/perl58/lib/
+5.8.0/PerlIO.pm line 0
        eval {...} called at /opt/perl58/lib/5.8.0/PerlIO.pm line 0
        XML::SAX::PurePerl::Reader::switch_encoding_stream('GLOB(0x11b
+1bc)','utf-8') called at /opt/perl58/lib/site_perl/5.8.0/XML/SAX/Pure
+Perl/Reader/Stream.pm line 71
        XML::SAX::PurePerl::Reader::Stream::set_encoding('XML::SAX::Pu
+rePerl::Reader::Stream=ARRAY(0x36d58c)','utf-8') called at /opt/perl5
+8/lib/site_perl/5.8.0/XML/SAX/PurePerl/XMLDecl.pm line 120
        XML::SAX::PurePerl::EncodingDecl('XML::SAX::PurePerl=HASH(0x13
+7210)','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called a
+t /opt/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl/XMLDecl.pm line 23
        XML::SAX::PurePerl::XMLDecl('XML::SAX::PurePerl=HASH(0x137210)
+','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /op
+t/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 142
        XML::SAX::PurePerl::prolog('XML::SAX::PurePerl=HASH(0x137210)'
+,'XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /opt
+/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 129
        XML::SAX::PurePerl::document('XML::SAX::PurePerl=HASH(0x137210
+)','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /o
+pt/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 102
        XML::SAX::PurePerl::_parse('XML::SAX::PurePerl=HASH(0x137210)'
+,'XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /opt
+/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 57
        XML::SAX::PurePerl::_parse_bytestream('XML::SAX::PurePerl=HASH
+(0x137210)','GLOB(0x11b1bc)') called at /opt/perl58/lib/site_perl/5.8
+.0/XML/SAX/Base.pm line 2299
        XML::SAX::Base::parse('XML::SAX::PurePerl=HASH(0x137210)','HAS
+H(0x137330)') called at /opt/perl58/lib/site_perl/5.8.0/XML/SAX/Base.
+pm line 2322
        XML::SAX::Base::parse_file('XML::SAX::PurePerl=HASH(0x137210)'
+,'GLOB(0x11b1bc)') called at /tmp/zdrs/z.pl line 13
BEGIN failed--compilation aborted.
        XML::SAX::PurePerl::Reader::switch_encoding_stream('GLOB(0x11b
+1bc)','utf-8') called at /opt/perl58/lib/site_perl/5.8.0/XML/SAX/Pure
+Perl/Reader/Stream.pm line 71
        XML::SAX::PurePerl::Reader::Stream::set_encoding('XML::SAX::Pu
+rePerl::Reader::Stream=ARRAY(0x36d58c)','utf-8') called at /opt/perl5
+8/lib/site_perl/5.8.0/XML/SAX/PurePerl/XMLDecl.pm line 120
        XML::SAX::PurePerl::EncodingDecl('XML::SAX::PurePerl=HASH(0x13
+7210)','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called a
+t /opt/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl/XMLDecl.pm line 23
        XML::SAX::PurePerl::XMLDecl('XML::SAX::PurePerl=HASH(0x137210)
+','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /op
+t/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 142
        XML::SAX::PurePerl::prolog('XML::SAX::PurePerl=HASH(0x137210)'
+,'XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /opt
+/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 129
        XML::SAX::PurePerl::document('XML::SAX::PurePerl=HASH(0x137210
+)','XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /o
+pt/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 102
        XML::SAX::PurePerl::_parse('XML::SAX::PurePerl=HASH(0x137210)'
+,'XML::SAX::PurePerl::Reader::Stream=ARRAY(0x36d58c)') called at /opt
+/perl58/lib/site_perl/5.8.0/XML/SAX/PurePerl.pm line 57
        XML::SAX::PurePerl::_parse_bytestream('XML::SAX::PurePerl=HASH
+(0x137210)','GLOB(0x11b1bc)') called at /opt/perl58/lib/site_perl/5.8
+.0/XML/SAX/Base.pm line 2299
        XML::SAX::Base::parse('XML::SAX::PurePerl=HASH(0x137210)','HAS
+H(0x137330)') called at /opt/perl58/lib/site_perl/5.8.0/XML/SAX/Base.
+pm line 2322
        XML::SAX::Base::parse_file('XML::SAX::PurePerl=HASH(0x137210)'
+,'GLOB(0x11b1bc)') called at /tmp/zdrs/z.pl line 13

        [download]
[reply]
[d/l]

In Section Seekers of Perl Wisdom