perlplackpsgi

Plack & taint mode


Is it recommended developing Plack applications (middlewares) with perl's taint mode?

If yes, how to start plackup and/or Starman in tainted mode? In the simple CGI script that was easily done with the shebang line.

Will perl -T /path/to/{plackup|starman} do the job? Or here is any recommended way? Or it is not recommended?

Any ideas, pointers, articles about the combination Plack+Taint mode?


Solution

  • We usually don't recommend people to develop Plack applications under the taint mode, simply because I personally don't believe in the usefulness of the taint mode.

    Plack's core utilities such as plackup and Plack::Utli particularly don't play well with the taint mode because it needs to compile the given .psgi file as a source code. If you really want to develop your application under the taint mode, you have to bypass the plackup and use Plack::Handler or Plack::Loader.