| Subject: | if $ENV (respectively $ENV{ENV}) is set, t/11-tainted.t fails |
On some systems/shells $ENV has content, for example "/etc/bash.bashrc"
In the module, you clean $ENV{PATH}, but not $ENV{ENV}. so the test fails:
ENV=bla prove -Ilib t/11-tainted.t
...
Insecure $ENV{ENV} while running with -T switch
...
Only
unset ENV
helps.
perlsec says:
Show quoted text
> Because some shells may use the variables IFS, CDPATH, ENV, and BASH_ENV, Perl checks > that those are
> either empty or untainted when starting subprocesses. You may wish to add something > like this to your setid and taint-checking scripts.
>
> delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # Make %ENV safer
thanks,
tina