| Subject: | Mail::Address taints its data due to 'use locale' |
Hi,
Mail::Address taints its data. Consider:
#!/usr/bin/perl -wT
use strict;
use Scalar::Util qw(tainted);
use Mail::Address;
my @a = map { $_->address } Mail::Address->parse('user@domain.invalid');
warn("tainted: $a[0]") if tainted($a[0]);
This outputs
tainted: user@domain.invalid at ./a.pl line 8.
for me on Perl 5.8.4 and 5.8.7 on Debian GNU/Linux.
Clearly the input data was not tainted here, but the output is. This happens because Mail::Address has 'use locale' in effect, and the regexps at the end of _tokenise(), lines 122-125, match for whitespace (\s). This taints the data as documented in the perllocale document.
I don't have a good patch, but this is unexpected behaviour and I think it should be at least documented.
Cheers,
--
Niko Tyni
ntyni@iki.fi