Re^4: Test::Pod:Coverage: excluding 'used' modules

[loris]

OK, I seem to have been indulging in some cargo-cult programming. My pod-covarage.t looked like this:

#!perl -T

use Test::More;
eval "use Test::Pod::Coverage 1.04";
plan skip_all => "Test::Pod::Coverage 1.04 required for testing POD co
+verage" if $@;
all_pod_coverage_ok();

If I delete the shebang line, everything is OK. I'm not sure where the line came from - I had to look up the meaning of the option '-T', so I don't think it was anything I added consciously. Strangely this line crops in other copies of pod-covarage.t for other modules where it doesn't cause a problem. So there is still something odd going on.

Cheers,

loris

[tobyink]

"-T" is for taint mode. I don't think many people use it these days. It adds a little metadata to all strings to track whether they come from the outside world or not; the idea being that string data from the outside world is potentially untrustworthy, so shouldn't be interpolated directly into SQL queries, etc.

Date::Manip does check an environment variable (which counts as tainted data) as part of its initialization, so that could be it?

[hippo]

I don't think many people use it these days.

That's probably going to be hard to estimate as it is enabled in scripts via the shebang line and scripts are less likely to be open source and published than other code. However, I use taint mode as much now as I did 10 years ago and find it a very useful line of defence. Proper handling of tainted data is a skill in itself and maybe it isn't taught so much now. That would be a shame.

[loris]

Good call. If I remove the '-T' option, the test runs successfully.

So what does Date::Manip read from the environment? Something to do with the timezone, I guess.

Thanks,

loris

[tobyink]

Yep. Before even that point it checks $ENV{DATE_MANIP} though, to decide which of two backend implementations to use.