Re: eval $fh while setuid...

[melguin]

Perhaps something like the following would work:

sub _read_config {
    my $tainted_fh = FileHandle->new("Config_filename", "r");
    if ($tainted_fh -~ /^(.+)$/) { my $fh = $1 }
    eval <$fh>;
    die "Config_filename improperly formatted:\n$@" if ($@);
    $fh->close();
}

NOTE: leaving the "/^(.+)$/" like that is BAD, BAD, BAD. Make it more specific.