Re^2: Debugging a module that's failing under taint mode

> I think you need to untaint $RealBin before adding it to lib.

yep this works for me

D:\tmp\pm>type findbin_taint.pl
use strict;
use warnings;
use FindBin qw($RealBin);

my $my_lib;
BEGIN {
    $RealBin =~ m/(.+)/;                               # just a demo, 
+you should only accept a safe path
    $my_lib = "$1/../lib";
}


use lib $my_lib;
print join"\n",@INC;

use PadWalker;                                         # no matter wha
+t you use will fail if @INC has a tainted entry

D:\tmp\pm>perl -T findbin_taint.pl
D:/tmp/pm/../lib
C:/Strawberry/perl/site/lib/MSWin32-x64-multi-thread
C:/Strawberry/perl/site/lib
C:/Strawberry/perl/vendor/lib
C:/Strawberry/perl/lib
D:\tmp\pm>
[download]

Cheers Rolf
_{(addicted to the Perl Programming Language :)

Wikisyntax for the Monastery}

Comment on Re^2: Debugging a module that's failing under taint mode Download Code

Replies are listed 'Best First'.
Re^3: Debugging a module that's failing under taint mode by Bod (Parson) on Jul 01, 2021 at 22:33 UTC
yep this works for me Thanks. Based on the above I now have this: `#!/usr/bin/perl -T use CGI::Carp qw(fatalsToBrowser); use FindBin qw($RealBin); my $safepath; BEGIN { if ($RealBin =~ m!^(/home/username/website/uk/www)!) { $safepath = "$1/../lib"; } else { die "Illegal use of software - visit www.website.uk to use thi +s site"; } } use lib "$RealBin/../lib"; use Site::HTML; <-- line 17` [download] This gives the same error `Insecure dependency in require while running with -T switch at index.pl line 18.` so I think I can safely assume that the problem is with the `Site::HTML` module. Edit: Whoops! Above I left it as `use lib "$RealBin/../lib";` Changing it to `use lib "$safepath";` works. So, at least I know `Site::HTML` can be used with taint mode. Now to find where it doesn't function.	[reply] [d/l] [select]
Re^4: Debugging a module that's failing under taint mode by LanX (Saint) on Jul 01, 2021 at 22:35 UTC
> so I think I can safely assume that the problem is with the `Site::HTML` module. nope, try `use lib $safepath;` instead. :) Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l] [select]
Re^5: Debugging a module that's failing under taint mode by Bod (Parson) on Jul 01, 2021 at 22:38 UTC
nope, try... Well spotted! I was editing my post as you typed that as I had spotted it too... Thanks for your help LanX	[reply]
Re^6: Debugging a module that's failing under taint mode by LanX (Saint) on Jul 01, 2021 at 22:48 UTC


Just another Perl shrine
	PerlMonks