Taint mode trap from Perl 5.6 to 5.8

The error occurs even with not-tainted variables! How come?

[phoenix_fly]

Hello my friends,

My hostīs server was recently upgraded to Debian Sarge and, with it, to Perl 5.8 as well. I was very happy untill I realized all my email-generating scripts stopped working right away, with the following error each time I tried to send out an email:

Software error:
Insecure $ENV{PATH} while running with -T switch at
/usr/share/perl5/MIME/Lite.pm line 2571.
1
Content-type: text/html
Software error:
error closing /usr/lib/sendmail: (exit 65280)
1

The script is basically a contact.cgi, with this code for the emailing:

use MIME::Lite;
MIME::Lite->send("sendmail");
# ... variables definition here
my $msg = MIME::Lite->new( 
 
 To => "$emailsite",
 From => "$from",
 Subject => "Contato >> $assunto",
 Type => 'text/html',
 Data => "$html" );
$msg->send(); # This call triggers the error. If I comment it out thereīs no error message. But thereīs no email too...

Sure, itīs a taint mode issue, and I heard Perl got more rigid about taintedness from 5.6 to 5.8. But the strange thing is that none of the following steps seem to do any help:

1) Checking for taintedness of all the variables that go into the MIME::Lite->new() method. None of them is tainted. By the way, i used this code to check each one of them:

if ( is_tainted($variable) ) { die "tainted"; } else { die "not tainte
+d"; }
sub is_tainted {
 return! eval { 
 join('',@_), kill 0; 
 1; 
 };
}

2) Checking for taintedness the $msg variable. Not tainted.
2) Setting the $ENV{'PATH'} from inside the script, with $ENV{'PATH'} = "/usr/local/bin:/usr/bin:/bin"; This one also doesnīt solve, but just changes the problem. The message becomes:

Software error:
Insecure dependency in exec while running with -T switch at /usr/share
+/perl5/MIME/Lite.pm line 2571.
1 
Content-type: text/html 
Software error:
error closing /usr/lib/sendmail: (exit 65280)
1 

Any ideas? Iīm clueless here.

Thanks

phoenxix_fly
PS: I also tried the delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; described in the perlsec, but still got the same error.

PS2: I also checked my host's directories /usr/local/bin:/usr/bin:/bin and they are also not-world-writtable, as perlsecs recomends.

PS3: I tested a to-the-bone version of the script wich doesnīt get any values from the outsite and redefines the path inside, but it still generates the same error:

#!/usr/bin/perl -wT
  use CGI::Carp qw( fatalsToBrowser );
  CGI::Carp::set_message("$^W");
  
  $ENV{'PATH'} = "/usr/local/bin:/usr/bin:/bin";
  delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};
  print "Content-type: text/html\n\n";
  use MIME::Lite;
   
  MIME::Lite->send("sendmail");
  my $msg = MIME::Lite->new( 
  
              To   => '[e-mail]',
              From  => '[e-mail]',
              Subject => 'test',
              Type  => 'text/html',
              Data  => "html" );
      $msg->send();
  print "ok";

[KevinADC]

contact the author of the module and see if they have any advice. This might be a reportable bug, at least one associated with the server you are using the script on.

[wruppert]

From [perldoc.perl.org...]

Cleaning Up Your Path

For "Insecure $ENV{PATH} " messages, you need to set $ENV{'PATH'} to a known value, and each directory in the path must be absolute and non-writable by others than its owner and group. You may be surprised to get this message even if the pathname to your executable is fully qualified. This is not generated because you didn't supply a full path to the program; instead, it's generated because you never set your PATH environment variable, or you didn't set it to something that was safe. Because Perl can't guarantee that the executable in question isn't itself going to turn around and execute some other program that is dependent on your PATH, it makes sure you set the PATH.

The PATH isn't the only environment variable which can cause problems. Because some shells may use the variables IFS, CDPATH, ENV, and BASH_ENV, Perl checks that those are either empty or untainted when starting subprocesses. You may wish to add something like this to your setid and taint-checking scripts.

[KevinADC]

it looks like he took that into consideration and is still get an error.

[phoenix_fly]

Hello Folks,

Hereīs the solution. Use this:

MIME::Lite->send("sendmail", "/usr/lib/sendmail -t -oi -oem");

instead of this:

MIME::Lite->send("sendmail");

After exaustive tests, I concluded that even if you clean up everything perlsec mentions, MIME:Lite will cause that taint error under Perl 5.8 unless you specify the path to sendmail in this call, from your code, and so avoid it uses itīs own default path (wich seems to be tainted, there in Lite.pm).

I tried to contact Yves, MIME:Liteīs creator, before posting this, but as I didnīt have any answer in 2 weeks, so, hereīs the solution for the Perl community.

Thanks for all the inputs

phoenix_fly

[KevinADC]

awesome, thanks for the update!