in reply to Unlinking Files and Taint Mode

You can still unlink files while in taint mode. At least the below script works fine:


#!/usr/bin/perl -wT

use CGI;
use CGI::Carp qw(fatalsToBrowser warningsToBrowser);

use strict;
use warnings;

unlink "temp.txt" or die "Can't unlink: $!";

print CGI->header();
print q{<html><body>Hello World</body></html>};

1;

__END__

[download]

When perlsec mentions unlink in its example, it's only with regard to the fact that $arg is tainted. If you want to use tainted data, you just need to launder it first.

In Section Seekers of Perl Wisdom