Insecure dependency in unlink while running with -T switch

[Regent]

I must say I'm a newbie, writing a script that tries to unlink a
particular file. Both the name of the file and that of the folder are
variable scalar strings. Now that I habitually write with -T and
strictures, I always get the error message "Insecure dependency in
unlink while running with -T switch". The relevant block of code:

if ("$root/$uploadDir/$origfn" ne "")
{
my $toDel = "$root/$uploadDir/$origfn";
unlink ($toDel) or die "$!";
}

where $root is the root path of the web site, $uploadDir is a folder for
temporary uploads, $origfn is the name of the file to be deleted.

How do I solve this problem? Thanks

 

[Gunnar Hjalmarsson]

I must say I'm a newbie, writing a script that tries to unlink a
particular file. Both the name of the file and that of the folder
are variable scalar strings. Now that I habitually write with -T
and strictures, I always get the error message "Insecure dependency
in unlink while running with -T switch".

How do I solve this problem?

You learn how to untaint a tainted variable by studying "perldoc
perlsec". If you "habitually" have -T enabled, I can't believe that
you haven't done so before.

 

[Joe Smith]

Both the name of the file and that of the folder are variable scalar strings.

If the variables are set from user input, they are tainted.

I always get the error message "Insecure dependency in
unlink while running with -T switch". The relevant block of code:
my $toDel = "$root/$uploadDir/$origfn";
unlink ($toDel) or die "$!";

Imagine that $root or $uploadDir has "../../../etc".
Perl is saying that you haven't done enough to eliminate that possibility.

How do I solve this problem? Thanks

Follow the suggestions in the docs that describe the -T switch.
-Joe

 

[John W. Krahn]

I must say I'm a newbie, writing a script that tries to unlink a
particular file. Both the name of the file and that of the folder are
variable scalar strings. Now that I habitually write with -T and
strictures, I always get the error message "Insecure dependency in
unlink while running with -T switch". The relevant block of code:

if ("$root/$uploadDir/$origfn" ne "")

"$root/$uploadDir/$origfn" will NEVER be equal to "" because you have
two literal / characters in the string.


John