Insecure switch while working in ENV{PATH}

[heatblazer]

Hello, monks.
I was trying a simple excersise script for using the local system`s sendmail while piping to it but the console shout me:

Insecure $ENV{PATH} while running with -T switch at ./perlmail.pl line
+ 30.

And my line 30 is a part of a subroutine:

sub send_mail {
    my ($from, $to, $subject, $data) = @_;
    open(MAIL, "| sendmail -t") or die "Can`t start sendmail: $!\n";
    print MAIL "To: $to\n";
    print MAIL "Cc: $subject\n";
    print MAIL "Data: $data\n";
    close(MAIL) or die "Can`t close sendmail filehandle: $!\n";
    
}

Why is that warning and what is my mistake?

[moritz]

This is described in perlsec, in particular read the section "Cleaning Up Your Path".

[marto]

After all this you're still not using MIME::Lite to make life easier for you?

[heatblazer]

Ahem... I am learning Perl so I am getting used to it... using a ready-made module is no good for a learner like me.

---

P.S.: I`ll use MIME::Lite in a real thing.

[marto]

Ahem, in your previous thread your script uses CGI, which is a "ready-made module", albeit a core module, and Email::Valid, which isn't a core module, so this must have been installed much like MIME::Lite would. Your argument against not using MIME::Lite has fallen apart somewhat.

[JavaFan]

Your PATH is insecure.

Set it. And use a full path to sendmail (if necessary).

See also man perldiag (search for "Insecure") and man perlsec.