problem using File::Find and taint

jonnyfolk has asked for the wisdom of the Perl Monks concerning the following question:

I've written the following script to help me find relevant scripts in my rather burgeoning cgi-bin directory. I would like to use the -T switch to run this but I'm getting a software error. How can I get round this?

#!/usr/bin/perl -wT
use strict;
use CGI::Carp qw(fatalsToBrowser warningsToBrowser);
use CGI ':standard'; 
use File::Find;

print "Content-type: text/html\n\n"; 

my $dir = '/myroot/public_html/cgi-bin';
my $word = param('word');
$word =~ /(^\w+|\s+$)/;
my $valid = $1;
unless ($valid) {
  print 'no word';
  exit;
}

find(\&find_word, $dir);

sub find_word
{

  if (($File::Find::name =~ /\.pl/) or ($File::Find::name =~ /\.cgi/))
+ {
    open FH, '<', $File::Find::name or die "Can't open $File::Find::na
+me: $!";
    while (my $line = <FH>) {
      chomp;
      if ($line =~ /$valid/) {
        print "$File::Find::name == $line\n\n"
        
      }
    }
  }
}
[download]

Software error:

Insecure dependency in chdir while running with -T switch at /usr/lib/
+perl5/5.8.8/File/Find.pm line 844, <FH> line 43175.
[download]

Comment on problem using File::Find and taint Select or Download Code

Replies are listed 'Best First'.
Re: problem using File::Find and taint by chromatic (Archbishop) on Dec 31, 2007 at 04:57 UTC
The File::Find documentation suggests that you can pass options to `find()` to provide an untainting pattern for directory names. You may be able to get away with: `find({ untaint => 1, wanted => \&find_word }, $dir);`	[reply] [d/l] [select]
Re^2: problem using File::Find and taint by jonnyfolk (Vicar) on Dec 31, 2007 at 05:06 UTC
That's done the trick, many thanks	[reply]
Re: problem using File::Find and taint by GrandFather (Saint) on Dec 31, 2007 at 04:58 UTC
You have to set the 'untaint' option: `find ({untaint => 1, wanted => \&find_word}, $dir);` [download] Perl is environmentally friendly - it saves trees	[reply] [d/l]
Re: problem using File::Find and taint by Anonymous Monk on Dec 31, 2007 at 13:35 UTC
You can also use `no_chdir => 1` as an option. This makes the problem go away, though your `&wanted` function may need to know about this.	[reply]