Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

I am trying to use FindBin in order to set a lib path that will be correct whether the program is called within the cgi environment or on the command line. However, FindBin does not work with taint.

I performed a search for taint and FindBin, but was unable to find a solution to this problem. I also tried to put my $ENV cleanup within a begin block, which also did not work.

Therefore I would like to know either how I can make FindBin work with taint enabled, or another way I could define my lib directory without resorting to two hardcoded lines, one for the web environment and one for the command line.

Thank you.

  • Comment on Variable use lib with taint (FindBin problem)

Replies are listed 'Best First'.
Re: Variable use lib with taint (FindBin problem)
by davorg (Chancellor) on Aug 17, 2004 at 14:45 UTC

    You'll probably get some better help if you explain a bit more about what you mean by "FindBin does not work with taint". What unexpected behaviour did you see? What errors did you get?

    A small sample program that demonstrates the problem wouuld help too.

    --
    <http://www.dave.org.uk>

    "The first rule of Perl club is you do not talk about Perl club."
    -- Chip Salzenberg

      To clarify, here is a sample program with the minimal amount of code needed to recreate the problem:
      #!/usr/local/bin/perl -T use warnings; use strict; use FindBin qw/$Bin/; use lib "$Bin/../lib"; use Data::Dumper;
      Data::Dumper may be replaced with another module (I also tried CGI) with the same result. The error message is:
      Insecure dependency in require while running with -T switch at ./test. +cgi line 11. BEGIN failed--compilation aborted

        You can untaint $Bin in a BEGIN block.

        #!/usr/bin/perl -T use warnings; use strict; use FindBin qw/$Bin/; BEGIN { if ($Bin =~ m!([\w\./]+)!) { $Bin = $1; } else { die "Bad directory $Bin\n"; } } use lib "$Bin/../lib"; use Data::Dumper; print "Hello!!\n";
        --
        <http://www.dave.org.uk>

        "The first rule of Perl club is you do not talk about Perl club."
        -- Chip Salzenberg

      I forgot a few more details.

      This is with perl 5.8.5.

      My expectation is that I should be able to use taint and still be able to get the information that FindBin delivers.

      I hope that this helps.

      janitored by ybiC: Retitle from "Addendum" because one-word nodetitles hinder site search