[rt.cpan.org #96291] t/08taint.t fails on perl 5.20.0

[Ed J via RT]

Sat Jun 21 19:22:11 2014: Request 96291 was acted upon.
Transaction: Correspondence added by ETJ
       Queue: Inline
     Subject: t/08taint.t fails on perl 5.20.0
   Broken in: 0.55
    Severity: (no value)
       Owner: Nobody
  Requestors: e...@cpan.org
      Status: open
 Ticket <URL: https://rt.cpan.org/Ticket/Display.html?id=96291 >


On further reflection, the previous logic and patch is slightly imperfect; a 
malicious user could include a directory under their control, put in a "chmod" 
command, then deny themselves write permission, and the directory would still 
be permitted. Instead, this patch, which replaces the previous one, will strip 
out directories either writable OR owned by the real uid:

diff --git a/Inline.pm b/Inline.pm
index 32868a3..3b62337 100644
--- a/Inline.pm
+++ b/Inline.pm
@@ -1075,7 +1075,7 @@ sub env_untaint {
                  join ';', grep {not /^\./ and -d $_
                                  } split /;/, $ENV{PATH}
                  :
-                 join ':', grep {/^\// and -d $_ and not ((stat($_))[2] & 0022)
+                 join ':', grep {/^\// and -d $_ and not (-W $_ or -O $_)
                                   } split /:/, $ENV{PATH};
 
     map {($_) = /(.*)/} @INC;