Taint mode trap from Perl 5.6 to 5.8

Andre_br has asked for the wisdom of the Perl Monks concerning the following question:

Hello my friends,

My host´s server was recently upgraded to Debian Sarge and, with it, to Perl 5.8 as well. I was very happy untill I realized all my email-generating scripts stopped working right away, with the following error each time I tried to send out an email:

Software error:
Insecure $ENV{PATH} while running with -T switch at
/usr/share/perl5/MIME/Lite.pm line 2571.
1
Content-type: text/html
Software error:
error closing /usr/lib/sendmail:  (exit 65280)
1
[download]

The script is basically a contact.cgi, with this code for the emailing:

use MIME::Lite;
MIME::Lite->send("sendmail");

# ... variables definition here

my $msg = MIME::Lite->new( 
   
                           To      => "$emailsite",
                           From    => "$from",
                           Subject => "Contato >> $assunto",
                           Type    => 'text/html',
                           Data    => "$html" );

$msg->send(); # This call triggers the error. If I comment it out ther
+e´s no error message. But there´s no email too...
[download]

Sure, it´s a taint mode issue, and I heard Perl got more rigid about taintedness from 5.6 to 5.8. But the strange thing is that none of the following steps seem to do any help:

1) Checking for taintedness of all the variables that go into the MIME::Lite->new() method. None of them is tainted. By the way, i used this code to check each one of them:

if ( is_tainted($variable) ) { die "tainted"; } else { die "not tainte
+d"; }

sub is_tainted {
   return ! eval { 
      join('',@_), kill 0; 
      1;     
   };
}
[download]

2) Checking for taintedness the $msg variable. Not tainted.
2) Setting the $ENV{'PATH'} from inside the script, with $ENV{'PATH'} = "/usr/local/bin:/usr/bin:/bin"; This one also doesn´t solve, but just changes the problem. The message becomes:

Software error:
Insecure dependency in exec while running with -T switch at /usr/share
+/perl5/MIME/Lite.pm line 2571.
1 
Content-type: text/html 
Software error:
error closing /usr/lib/sendmail:  (exit 65280)
1
[download]

Any ideas? I´m clueless here.

Thanks

Andre_br
UPDATE: I also tried the delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; described in the perlsec, but still got the same error.

UPDATE2: I also checked my host's directories /usr/local/bin:/usr/bin:/bin and they are also not-world-writtable, as perlsecs recomends.

Comment on Taint mode trap from Perl 5.6 to 5.8 Select or Download Code

Replies are listed 'Best First'.

Re: Taint mode trap from Perl 5.6 to 5.8
by PodMaster (Abbot) on Sep 16, 2005 at 02:06 UTC

MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
** The third rule of perl club is a statement of fact: pod is sexy.

[reply]

Re^2: Taint mode trap from Perl 5.6 to 5.8

by Andre_br (Pilgrim) on Sep 16, 2005 at 02:14 UTC

I wish you were right, but this isn´t it yet. I checked them all and, for an extra check now, I replaced it with a typed value:

           my $msg = MIME::Lite->new( 
   
                           To      => "$emailsite",
                           From    => "me\@host.com",
                           Subject => "Contato >> $assunto",
                           Type    => 'text/html',
                           Data    => "$html" );

           $msg->send();
[download]

I even replaced THEM ALL with typed values and didn´t work either!

[reply]
[d/l]

Re^3: Taint mode trap from Perl 5.6 to 5.8

by PodMaster (Abbot) on Sep 16, 2005 at 02:36 UTC

Didn't work either

Insecure dependency in exec while running with -T switch at /usr/share/perl5/MIME/Lite.pm line 2571.

    my %p = @_;
    $p{Sendmail} ||= "/usr/lib/sendmail";

    ### Start with the command and basic args:
    my @cmd = ($p{Sendmail}, @{$p{BaseArgs} || ['-t', '-oi', '-oem']})
+;

    ### See if we are forcibly setting the sender:
    $p{SetSender} = 1 if defined($p{FromSender});

    ### Add the -f argument, unless we're explicitly told NOT to:
    unless (exists($p{SetSender}) and !$p{SetSender}) {
        my $from = $p{FromSender} || ($self->get('From'))[0];
        if ($from) {
        my ($from_addr) = extract_addrs($from);
        push @cmd, "-f$from_addr"       if $from_addr;
        }
    }

    ### Open the command in a taint-safe fashion:
    my $pid = open SENDMAIL, "|-";
    defined($pid) or die "open of pipe failed: $!\n";
    if (!$pid) {    ### child
        exec(@cmd) or die "can't exec $p{Sendmail}: $!\n";
        ### NOTREACHED
    }
[download]

[reply]
[d/l]
[select]

Re^4: Taint mode trap from Perl 5.6 to 5.8 - going mad!

by Andre_br (Pilgrim) on Sep 16, 2005 at 02:48 UTC

Re^5: Taint mode trap from Perl 5.6 to 5.8 - going mad!

by fizbin (Chaplain) on Sep 16, 2005 at 12:04 UTC

Some notes below your chosen depth have not been shown here


The stupid question is the question not asked
	PerlMonks