[Bug 297394] Default shell changing from csh to sh has unexpected fallout

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297394

--- Comment #7 from Benjamin Jacobs <[email protected]> ---
(In reply to Helge Oldach from comment #5)
Skimmed throught your doc, it is still unclear why would having ENV defined
would make a program fails as taints are applied to hash values, not hashes nor
keys.

perlrun(1) says the following:

     Perl makes all environment variables available to the program being
     executed, and passes these along to any child processes it starts.
     However, programs running setuid would do well to execute the following
     lines before doing anything else, just to keep people honest:

         $ENV{PATH}  = "/bin:/usr/bin";    # or whatever you need
         $ENV{SHELL} = "/bin/sh" if exists $ENV{SHELL};
         delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};


So maybe one should try to patch SA to do do just that, near the entry
point(s)?

-- 
You are receiving this mail because:
You are the assignee for the bug.