| Subject: | Date::Manip 5.48 is not taint safe |
Line 39 of 5.48's Manip.pm uses a mechanism that is no longer
recommended for determining whether or not taint-mode is in effect. This
issue results in Date::Manip not being taint-mode-safe. The below quoted
excerpt is from Perl Training Australia Pty Ltd's "Perl Security
(release 1.5)" PDF by Paul Fenwick and Jacinta Richardson.
$ perl -t -MDate::Manip -e ''
Insecure dependency in eval while running with -t switch at
/usr/lib/perl5/site_perl/5.8.8/Date/Manip.pm line 39.
$
"In Perl 5.8.x the special variable ${^TAINT} can be used to determine
if perl is running in taint mode. In Perl 5.6.0 there is no easily
reliable way to detect if the program is using taint mode without
interacting with the operating system in some way. The common practice
of examining $^X cannot be recommend as it is possible to replace $^X
with untainted [sic] data."