Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.

Perl Security Patterns Comprehensive security guidelines for Perl applications covering input validation, injection prevention, and secure coding practices. When to Activate Handling user input in Perl applications Building Perl web applications (CGI, Mojolicious, Dancer2, Catalyst) Reviewing Perl code for security vulnerabilities Performing file operations with user supplied paths Executing system commands from Perl Writing DBI database queries How It Works Start with taint aware input boundaries, then move outward: validate and untaint inputs, keep filesystem and process execution constrained, and use parameterized DBI queries everywhere. The examples below show the safe defaults this skill expects you to apply before shipping Perl code that touches user input, the shell, or the network. Taint Mode Perl's taint mode ( T ) tracks data from external sources and prevents it from being used in unsafe operations without explicit validation. Enabling Taint Mode Untainting Pattern Input Validation Allowlist Over Blocklist Length Constraints Safe Regular Expressions ReDoS Prevention Catastrophic backtracking occurs with nested quantifiers on overlapping patterns. Safe File Operations Three Argument Open TOCTOU Prevention and Path Traversal Use File::Temp for temporary files ( tempfile(UNLINK = 1) ) and flock(LOCK EX) to prevent race conditions. Safe Process Execution List Form system and exec Also use Capture::Tiny for capturing stdout/stderr from external commands safely. SQL Injection Prevention DBI Placeholders Dynamic Column Allowlists DBIx::Class (ORM Safety) Web Security XSS Prevention CSRF Protection Use constant time comparison when verifying tokens. Most web frameworks (Mojolicious, Dancer2, Catalyst) provide built in CSRF protection — prefer those over hand rolled solutions. Session and Header Security Output Encoding Always encode output for its context: HTML::Entities::encode entities() for HTML, URI::Escape::uri escape utf8() for URLs, JSON::MaybeXS::encode json() for JSON. CPAN Module Security Pin versions in cpanfile: requires 'DBI', '== 1.643'; Prefer maintained modules : Check MetaCPAN for recent releases Minimize dependencies : Each dependency is an attack surface Security Tooling perlcritic Security Policies Running perlcritic Quick Security Checklist Check What to Verify Taint mode T flag on CGI/web scripts Input validation Allowlist patterns, length limits File operations Three arg open, path traversal checks Process execution List form system, no shell interpolation SQL queries DBI placeholders, never interpolate HTML output encode entities() , template auto escape CSRF tokens Generated, verified on state changing requests Session config Secure, HttpOnly, SameSite cookies HTTP headers CSP, X Frame Options, HSTS Dependencies Pinned versions, audited modules Regex safety No nested quantifiers, anchored patterns Error messages No stack traces or paths leaked to users Anti Patterns Remember : Perl's flexibility is powerful but requires discipline. Use taint mode for web facing code, validate all input with allowlists, use DBI placeholders for every query, and encode all output for its context. Defense in depth — never rely on a single layer.

perl-security