Bug#616288: perl-modules: SelfLoader breaks when taint-checking is enabled

[Devin Carraway]

Package: perl-modules
Version: 5.10.0-19lenny3
Severity: normal


Packages using SelfLoader (older ones, generally) seem to have broken recently
when taint checking is enabled.  I haven't narrowed down exactly where this
was introduced, but I don't believe I saw it prior to the 5.0.8 point release
of Lenny, which included perl security fixes.

Quickie repro case, using News::Article (in debian as libnews-article-perl),
where I first noticed this:

$ perl -w -MNews::Article -T -e '$x = new News::Article("")'
Insecure dependency in eval while running with -T switch at /usr/share/perl/5.10/SelfLoader.pm line 59

Slightly longer repro case without depending on libnews-article-perl:

$ cat > Foo.pm <<FOO_PM
package Foo;
use SelfLoader;
1;
__DATA__
sub foo {
  print "foo called\n";
}
FOO_PM

$ perl -I. -MFoo -T -e 'Foo->foo()'
Insecure dependency in eval while running with -T switch at /usr/share/perl/5.10/SelfLoader.pm line 59

I've also reproduced this with 5.10.1-17 on Sid.

-- System Information:
Debian Release: 5.0.8
  APT prefers oldstable
  APT policy: (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages perl-modules depends on:
ii  perl                     5.10.0-19lenny3 Larry Wall's Practical Extraction 

perl-modules recommends no packages.

perl-modules suggests no packages.

-- debconf-show failed