Hi,
I'm using Catalyst with FormFu in Apach2 and have switched on the taint mode
in Apache config:
PerlTaintCheck on
Pages without a form are working without problems.
Now I have a simple contact form created with FormFu which works fine in
Catalyst Development Server.
But in Apache I get the following error:
[error] Caught exception in MyApp::Controller::Contact->index "Insecure
dependency in require while running with -T switch at
/usr/local/share/perl/5.10.1/HTML/FormFu/Util.pm line 371.
at /usr/local/share/perl/5.10.1/HTML/FormFu/Role/CreateChildren.pm line 136
at /usr/local/share/perl/5.10.1/HTML/FormFu/ObjectUtil.pm line 179"
Now I've modified the Util.pm so that I get a more detailed view on the
tainted variable:
if ( !exists $::INC{$class} ) {
#Added by myself:
if (tainted($class))
{
die "This require is tainted: " . $class;
}
eval { require $class }; #This is line 371
.
Now I get the following error message:
[error] Caught exception in MyApp::Controller::Contact->index "This require
is tainted: HTML/FormFu/Element/Select.pm at
/usr/local/share/perl/5.10.1/HTML/FormFu/Util.pm line 376.
at /usr/local/share/perl/5.10.1/HTML/FormFu/ObjectUtil.pm line 179"
I think, the problem is, that FormFu reads the .yml file and determines
which Modules to 'require'. Due to the require value is read from a file, I
get an Insecure Dependency Error.
One solution is to disable TaintMode, but I think this isn't recommended.
How can I solve this problem?
Sorry for my recently flood of questions but I can't find a solution by
googling.
Thanks a lot for your help!!
Stefan
_______________________________________________
List: [email protected]
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/[email protected]/
Dev site: http://dev.catalyst.perl.org/
