comment on

From a users perspective, it is a good thing to know that the test script is not going to do anything odd with your personel system/data.

That's not what taint mode does, though -- it flags external data, not internal data. A test script could very well do this evil thing:

WARNING -- Don't try this at home.

#!/usr/bin/perl -T

#### DO NOT ACTUALLY RUN THIS CODE ####

use Test::More tests => 1;
use File::Path;
use File::Spec;

my $n = rmtree( File::Spec->rootdir(), 0, 1);

ok( $n, "Deleted at least one file from the root directory" );
[download]

Sadly, Perl doesn't have a nice sandbox like Java. Good reason not build/test modules as root, eh?

What the taint flag will do is limit the directories in @INC. From perlsec:

When the taint mode ("-T") is in effect, the "." directory is removed from @INC, and the environment variables "PERL5LIB" and "PERLLIB" are ignored by Perl. You can still adjust @INC from outside the program by using the "-I" command line option as explained in perlrun. The two environment variables are ignored because they are obscured, and a user running a program could be unaware that they are set, whereas the "-I" option is clearly visible and therefore permitted.

For testing, I'm still not sure if that is or isn't desireable. What if a user has their own private installation in PERL5LIB?

-xdg

Code written by xdg and posted on PerlMonks is public domain. It is provided as is with no warranties, express or implied, of any kind. Posted code may not have been tested. Use of posted code is at your own risk.

In reply to Re^2: Why a taint flag on test files? by xdg
in thread Why a taint flag on test files? by xdg

Are you posting in the right place? Check out Where do I post X? to know for sure.
Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:
<code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>
Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
Want more info? How to link or How to display code and escape characters are good places to start.


laziness, impatience, and hubris
	PerlMonks