[Rt-devel] taint checks when running GID

Brent B. Powers bbp2006 at pathology.columbia.edu
Thu Aug 12 13:40:37 EDT 2004

Last spring, a couple of people had sudden onset of taint problems, 
specifically in Locale::Maketext::Guts::_compile

We started having occasional problems a couple of weeks ago. As of today, 
however, it's an epidemic, and nothing is working. I'm running freebsd, 
ports of everything, rt-3.0.11.

Flailing about, I tried replacing

my $sub = eval(join '', @code);
die "$@ while evalling" . join('', @code) if $@; # Should be impossible.


my($evalcode, $sub);
$sub = join('', @code);
  no locale;
  $sub=~ m/^(.*)/;
  $evalcode = $1;
  $sub = eval($evalcode);
  die "$@ while evalling $evalcode" if $@; # Should be impossible.

on the theory that the regex would untaint. In fact, that appears to have 
worked. Unfortunately, I still can't do anything. I've got taint errors at

error: 	Insecure dependency in mkdir while running with -T switch at 
/usr/local/lib/perl5/5.8.4/File/Path.pm line 159.
155: 	unless (-d $parent or $path eq $parent) {	
156: 	push(@created,mkpath($parent, $verbose, $mode));	
157: 	}	
158: 	print "mkdir $path\n" if $verbose;	
159: 	unless (mkdir($path,$mode)) {	
160: 	my $e = $!;	
161: 	# allow for another process to have created it meanwhile	
162: 	croak "mkdir $path: $e" unless -d $path;	
163: 	}

when trying to load the main page, and, when attempting to create a ticket:

ror: 	Insecure dependency in require while running with -T switch at 
line 21
187: 	# whether they should generate a full stack trace (confess() and 
188: 	# or simply report the caller's package (croak() and carp()), 
189: 	# confess() and croak() die, carp() and cluck() warn.	
191: 	sub croak { die shortmess @_ }	
192: 	sub confess { die longmess @_ }	
193: 	sub carp { warn shortmess @_ }	
194: 	sub cluck { warn longmess @_ }	
code stack: 	/usr/local/lib/perl5/5.8.4/Carp.pm:191

Ummm... Help???? (Oh, I've cleared the mason-handler cache whilst 
restarting apache with each.)

Brent B. Powers
Manager, Information Technology
Department of Pathology
Columbia University

More information about the Rt-devel mailing list