Debugging taint

SilasTheMonk has asked for the wisdom of the Perl Monks concerning the following question:

I am having an issue where my taint checking CGI scripts run fine but collapse when debugged. I have resolved this down to two files:

package DebugApp;
require CGI::Application::Plugin::LogDispatch;
1
[download]

and

#!/usr/bin/perl -wT

# amend @INC without taint
use FindBin;
my $path = $FindBin::RealBin;
$path =~ /^(.+)$/;
$path = $1;
unshift @INC, $path;

require DebugApp;
[download]

At this point those of you familiar with CGI::Application should be able to see where this is coming on. I have resolved this down further to where the module file becomes:

package DebugApp;
use Log::Dispatch::Output;
use base qw( Log::Dispatch::Output );
1
[download]

At this point the error is

  DB<1> c
Insecure dependency in require while running with -T switch at C:/Users/SilasTheMonk
/Downloads/Documents/web-3/public_html/cgi-bin/DebugApp.pm line 8.
 at C:/Users/SilasTheMonk/Downloads/Documents/web-3/public_html/cgi-bin/DebugApp.pm
line 8
        DebugApp::BEGIN() called at C:/Users/SilasTheMonk/Downloads/Documents/web-3/
public_html/cgi-bin/DebugApp.pm line 8
        eval {...} called at C:/Users/SilasTheMonk/Downloads/Documents/web-3/public_
html/cgi-bin/DebugApp.pm line 8
        require DebugApp.pm called at Debug.cgi line 11
BEGIN failed--compilation aborted at C:/Users/SilasTheMonk/Downloads/Documents/web-3
/public_html/cgi-bin/DebugApp.pm line 8.
 at C:/Users/SilasTheMonk/Downloads/Documents/web-3/public_html/cgi-bin/DebugApp.pm
line 8
        require DebugApp.pm called at Debug.cgi line 11
Compilation failed in require at Debug.cgi line 11.
 at Debug.cgi line 11
Debugged program terminated.  Use q to quit or R to restart,
  use o inhibit_exit to avoid stopping after program termination,
  h q, h R or h o to get additional info.

  DB<1>

If I simplify any further or run it outside of the debugger, the problem goes away. I have investigated a bit further and I believe the problems lies in the "base.pm" module. However I do not really understand the internals of that module yet and I am a bit stuck.

Comment on Debugging taint Select or Download Code

Replies are listed 'Best First'.
Re: Debugging taint by Anonymous Monk on Sep 24, 2008 at 05:26 UTC
`use Scalar::Util 'tainted'; print tainted($_), " $_\n" for @INC; eval { require DebugApp; }; warn $@ if $@;` [download]	[reply] [d/l]
Re^2: Debugging taint by SilasTheMonk (Chaplain) on Sep 24, 2008 at 19:10 UTC
The response is not actually as helpful as it looks. "taint" seems to be my regular subject and I had already tried all the ideas it contains. There is something deeper going on in I believe the "base" module.	[reply]