http://qs321.pair.com?node_id=11145148


in reply to Re^6: Any security holes?
in thread Any security holes?

Your script attempts to write tainted data to the filesystem. Running in taint mode protects you from doing this ...

This is not how taint mode works. You can write tainted data to the file system just fine. It is passing tainted data to the OS (via the file system, starting processes and the like) where taint mode kicks in.

A frequent path to taint failures is whenever environment variables like e.g. $ENV{HOME} or $ENV{TMP} are used by Perl modules. This may also differ between platforms. For example, my current Linux desktops don't even have $ENV{TMP} defined, whereas on Windows it is usually set.