Pod::Usage and Taint Mode

[ghenry]

Dear all,

Has anyone done a workaround or similar when using Pod::Usage and Taint Mode, with the --man option?

I keep getting on Linux (Fedora Core 5, perl 5.8.8):

Insecure dependency in system while running with -T switch at /usr/lib
+/perl5/5.8.8/Pod/Usage.pm line 547.

Script code has:

pod2usage( -verbose => 2 ) if $options{man};

and offending Pod::Usage code is:

539     ## Now translate the pod document and then exit with the desir
+ed status
540     if ( !$opts{"-noperldoc"}
541              and  $opts{"-verbose"} >= 2
542              and  !ref($opts{"-input"})
543              and  $opts{"-output"} == \*STDOUT )
544     {
545        ## spit out the entire PODs. Might as well invoke perldoc
546        my $progpath = File::Spec->catfile($Config{scriptdir}, "per
+ldoc");
547        system($progpath, $opts{"-input"});
548     }
549     else {
550        $parser->parse_from_file($opts{"-input"}, $opts{"-output"})
+;
551     }
552
553

Thanks,
Gavin.

[herveus]

Howdy!

Off the top of my head, I'd suspect $ENV{PATH} as the offending item. I'd try setting $ENV{PATH} (possibly to '' unless you need it elsewhere) to some fixed value to untaint it.

[ghenry]

Nah, that's already been done ;-)

Here are some quick read links:
Pod docs
Syntax highlighted HTML

For reference, here is the complete program:

Read more... (34 kB)

The --man option is the only thing left to fix.

Thanks,
Gavin.

[mamawe]

> The --man option is the only thing left to fix.

Excuse me for reviving the thread but I had the same problem today and found a working solution elsewhere on the web that I would like to appear here:

pod2usage({-verbose => 2, -input => \*DATA});

or, if called inside a package

pod2usage({-verbose => 2, -input => \*::DATA});

[tye]

I'd guess you need to untaint $opts{"-input"} before passing it to system.

[Anonymous Monk]

Late update: CPAN#29978 covers this, and it is fixed since 1.36.

Ob-mention: The CHANGES file also says the package is dead, but I didn't see reference to a replacement for the (very handy) pod2usage