Bug: Calling mailnotify gives a taint error in Perl

Calling mailnotify results in the error message

Insecure dependency in connect while running with -T switch at
/usr/lib/perl5/5.8.1/i586-linux-thread-multi/IO/Socket.pm line 114.

This is at the connect() to SMTPHOST.

The strange thing: mailnotify worked a few days ago. Perl was not upgraded. I don't know why this error suddenly appears and wasn't there previously.

Test case

Environment

-- JoachimSchrod - 15 Jun 2005

Impact and Available Solutions

Follow up

This also happens when one registers a new account on a freshly installed TWiki, using TWikiRegistrationPub. That registration wants to send an email and runs into the same error.

-- JoachimSchrod - 12 Oct 2005

Fix record

• Net.pm.diff untaints $mailHost.

This may be just a workaround and not the real fix; I don't know if you have a general concept of untainting preference variables.

Discussion