TB2::CanLoad + TB2_FORMATTER_CLASS + taint mode - Githubissues

Test-More / TB2

Test::Builder version 2, the next generation of building testing modules in Perl

Other

1 stars 0 forks source link

TB2::CanLoad + TB2_FORMATTER_CLASS + taint mode #216

Closed schwernbot closed 10 years ago

schwernbot commented 10 years ago

From: @schwern Date: Friday Apr 12, 2013 at 15:26 GMT Orig: https://github.com/Test-More/test-more/issues/356

Setting TB2_FORMATTER_CLASS breaks under taint mode. We're loading a class read from an environment variable which fails.

Put in some checks to make sure that it's a valid package name
Untaint the result before requiring it

Be sure to catch things like ::path::to::nasty::file