de-taint doesn't work after upgrading perl

[mickjames]

Hi,

In a cgi script I'm detainting an input variable as
$FORM{'input'} =~ tr/A-Z//cd;
and then passing it to a system call as
system "proggy",$FORM{'input'};

It was working in old perl 5.6 but doesn't in 5.8.
Perl complains about "Insecure dependency".
How should it be detainted now?

Thanks much!

 

[Gunnar Hjalmarsson]

In a cgi script I'm detainting an input variable as
$FORM{'input'} =~ tr/A-Z//cd;
and then passing it to a system call as
system "proggy",$FORM{'input'};

It was working in old perl 5.6 but doesn't in 5.8.
Perl complains about "Insecure dependency".
How should it be detainted now?

Didn't know the above ever was an allowed way to untaint. This is an
equivalent that does untaint:

$FORM{'input'} = join '', $FORM{'input'} =~ /[A-Z]/g;

Please also study

perldoc perlsec

 

[mickjames]

Thanks for your help. Perl has the best support of all!