Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm putting together some notes for a dev team on how to write secure Perl code - especially taking into account the current OWASP top 10 web application vulnerabilities. For cross-site scripting I've included information on ensuring that all output to the browser is checked and escaped where necessary, but I'm looking for more automated mechanisms that would mean a developer doesn't have to think about every output statement and, potentially, miss one. Perl's 'taint' function sounds like it should be a help because it distrusts all user input, but it doesn't complain on tainted data being output to the browser. Apart from checking all output statements individually (probably by calling a generic sanitizing function) does anyone have any ideas on how Perl can help with this with existing libraries or techniques?

share|improve this question
Good question, but I really think it should be on stack overflow or maybe – Jan Hudec Sep 2 '13 at 5:43
I'm specifically interested in how developers are writing programmatic solutions to this - i.e. what code might look like or consider. I agree it's partly about process, but it's more about hands-on development techniques I believe. – David Scholefield Sep 2 '13 at 10:00

You might want to take a look at the article CERT Secure Coding Initiative Tackles Standard for Perl, the slides about Perl::Critic for Security Audits, and Perl::Critic in general.

share|improve this answer
would you mind explaining what each of these resources does and what they're good for? "Link-only answers" are not quite welcome at Stack Exchange – gnat Sep 2 '13 at 7:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.