comment on

Since the problem is with MIME::Lite using $ENV{PATH}, if Corion's advice of switching to SMTP instead of sendmail doesn't work for you, I believe you should be able to untaint $ENV{PATH} before MIME::Lite uses it.

perlsec has a whole section on Cleaning Up Your Path

My experiments say yes. $ENV{PATH} = '/bin:/usr/bin:/usr/sbin'; delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; works for me to untaint the use of $ENV{PATH} before MIME::Lite tries to call sendmail. (That example assumes you trust /bin:/usr/bin:/usr/sbin, which I cannot decide for you.) To be on a system that has sendmail, I had to use perl v5.8.5, which isn't exactly cutting edge, so things may have changed since then... but in my experiments, I could untaint the PATH before MIME::Lite uses it.

In reply to Re: Insecure CPAN module in taint mode by pryrt
in thread Insecure CPAN module in taint mode by Bod

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


Syntactic Confectionery Delight
	PerlMonks