Skip Menu |

This queue is for tickets about the Term-ShellUI CPAN distribution.

Report information
The Basics
Id: 45556
Status: resolved
Priority: 0/
Queue: Term-ShellUI

People
Owner: Nobody in particular
Requestors: christian.kuelker [...] cipworx.org
Cc:
AdminCc:

Bug Information
Severity: Normal
Broken in: 0.86
Fixed in: (no value)



Subject: Insecure dependency in open while running with -T switch
Insecure dependency in open while running with -T switch at /usr/local/share/perl/5.8.8/Term/ShellUI.pm line 1888. Perl Version 5.8.8 Message pops up when saving history at the end of this test program after issuing "quit". (Workaround: comment out 'history_file'.) #!/usr/bin/perl -w -T #Insecure dependency in open while running with -T switch at /usr/local/share/perl/5.8.8/Term/ShellUI.pm line 1888. use strict; use warnings; use Term::ShellUI; delete @ENV{qw(PATH IFS CDPATH ENV BASH_ENV)}; # Make %ENV safe my $term = new Term::ShellUI( prompt => '> ', commands => { quit => { desc => 'Quit this program', maxargs => 0, method => sub { shift->exit_requested(1); }, } }, history_file => '~/.secure-history', ); print 'Using ' . $term->{term}->ReadLine . "\n"; $term->run();
On Wed Apr 29 09:50:00 2009, ckuelker wrote: Show quoted text
> Insecure dependency in open while running with -T switch at > /usr/local/share/perl/5.8.8/Term/ShellUI.pm line 1888. > > Perl Version 5.8.8 > > Message pops up when saving history at the end of this test program > after issuing "quit". (Workaround: comment out 'history_file'.) > > delete @ENV{qw(PATH IFS CDPATH ENV BASH_ENV)}; # Make %ENV safe
... Show quoted text
> history_file => '~/.secure-history',
It's because you're specifying ~ in your history_file path, so Term::ShellUI needs to expand it to your home directory. Problem is, $ENV{HOME} is tainted. Either expand your history_file path before passing it to Term::ShellUI (history_file => "/home/bronson/.secure-history") or untaint $ENV{HOME}.