220 taint

[brainbuz]

Isolating my proposed change of strict to getoptlong in a runperl block, also deleted a global stricture at line 16.

[atoomic]

I'm not sure about this change? what's the reason?

[jkeenan]

I'm not sure about this change? what's the reason?

In #220 (comment), @brainbuz wrote:

taint.t had a global stricture and in a runperl block was testing the 'use' command with -T, in the PR I propose changing 'use strict' to 'use Getopt::Long', any Core module would serve the intention of the test.

So he appears to feel that using strict as the module to test the -T switch is no longer the best choice.

I'm not sure I agree that we need to make a change here, but if we decide to do so, I'd rather use a module that, say, lives under lib or ext rather than one that is dual-life.

Thank you very much.
Jim Keenan

[jkeenan]

I have reviewed the original bug ticket in RT that gave rise to line 2528 above, as well as the commit that introduced that line and the unit test in which that line is found. The point of that line can be illustrated with this program:

$ cat rt-122669.pl 
#!perl -T
# https://github.com/Perl/perl5/commit/64ff300be0f7714585466af5bb87b2e37db5082a

# tainted constant
use constant K=>$^X;

# Just reading the constant for the sake of folding can enabled
# taintedness at compile time.
0 if K;

# Taintedness is still on when the ‘strict.pm’ SV is created, so
# require croaks on it (‘Insecure dependency’).
use strict;
#use less 'please';

... which is extracted from Father C's commit message in the commit cited.

Run this program, first in perl-5.18 and then in perl-5.20 (or any later version, including a perl built in our alpha branch). The earlier version produced the surprising exception about which the original RT was concerned.

$ perl -v | head -2 | tail -1
This is perl 5, version 18, subversion 4 (v5.18.4) built for x86_64-linux

$ perl -T rt-122669.pl 
Insecure dependency in require while running with -T switch at rt-122669.pl line 13.
BEGIN failed--compilation aborted at rt-122669.pl line 13.

If, in the program above, you comment out use strict; and substitute any other use statement, you get exactly the same results in perl-5.18 versus later versions. It's the use that is important here, not what is being used.

I think if we changed this to something other than strict, generations to come would be puzzled as to why we had done so. So I recommend leaving the line as is -- which means that there's nothing left to be altered via this p.r. -- which means the p.r. is closable without merging.

I will do so in 3 days time unless I hear otherwise.

Thank you very much.
Jim Keenan

[jkeenan]

@brainbuz, Could you revise this pull request so that it just contains changes to t/op/taint.t?

In commit c5e9d4d, I just now merged into alpha changes for t/op/sprintf2.t, t/op/stash.t, t/op/sub.t-- your p.r. #312. So changes to those files do not have to be duplicated in this p.r.

Also, a smaller point:

Could I ask that you not put the Issue number a p.r. is referencing in the Subject of a pull request? If your Subject is, as in this case, "220 taint", that renders as "220 taint #313" in the GitHub GUI and as "220 taint (#313)" in my email. Speaking only for myself, I find all those numbers confusing.

Thank you very much.
JIm Keenan