perltaint

I don't understand the Perl Taint mode error message

I have some old Perl code I have been told is vulnerable to Cross site scripting attacks or SQL injection attacks. I figured I'd turn on taint mode by changing the shebang from #!/usr/local/bin/perl to #!/usr/local/bin/perl -T and now I get this error message:

Insecure dependency in require while running with -T switch at <big long path>/main.cgi line 26.

The code looks like this:

  1 #!/usr/local/bin/perl  -T
.
.
.
 12 use strict;
 13
 14 use vars qw( %opt $VERSION );
 15
 16 use CGI qw/:standard *table start_ul/;
 17 use CGI qw(:debug);
 18 use CGI::Carp qw( fatalsToBrowser );
 19 #use CGI::Pretty qw( :html3 );
 20 $CGI::Pretty::INDENT = "    ";
 21 use Tie::IxHash;
 22 use FindBin qw($Bin); 
 23 use lib "$Bin/../../lib";
 24 use lib "$Bin/../lib";
 25
 26 use Common::Config;

The Common::Config is has this ownership and permissions:

$ ls -l lib/Common/Config.pm
-r--r--r--. 1 someguy example 5840 Oct  9 20:08 lib/Common/Config.pm

I tried changing the ownership to apache but I still get the taint error message.

UPDATE:

I have tried to untaint my $Bin variable like so:

use FindBin qw($Bin);           # Where are we ?
if ($Bin =~ /^([-\@\w.]+)$/) {
        $Bin = $1;                      # $data now untainted
} else {
        die "Bad data in '$Bin'";       # log this somewhere
}

But I still get the taint error about use Common::Config;

Solution

  • Do you have a use lib statement where an insecure variable is added to the include path?

    https://perldoc.perl.org/perlsec.html

    Note that if a tainted string is added to @INC, the following problem will be reported:

    Insecure dependency in require while running with -T switch