https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297394
--- Comment #7 from Benjamin Jacobs <[email protected]> --- (In reply to Helge Oldach from comment #5) Skimmed throught your doc, it is still unclear why would having ENV defined would make a program fails as taints are applied to hash values, not hashes nor keys. perlrun(1) says the following: Perl makes all environment variables available to the program being executed, and passes these along to any child processes it starts. However, programs running setuid would do well to execute the following lines before doing anything else, just to keep people honest: $ENV{PATH} = "/bin:/usr/bin"; # or whatever you need $ENV{SHELL} = "/bin/sh" if exists $ENV{SHELL}; delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; So maybe one should try to patch SA to do do just that, near the entry point(s)? -- You are receiving this mail because: You are the assignee for the bug.
