Cursor rule

1---
2paths:
3  - "**/*.pl"
4  - "**/*.pm"
5  - "**/*.t"
6  - "**/*.psgi"
7  - "**/*.cgi"
8---
9# Perl Security
10 
11> This file extends [common/security.md](../common/security.md) with Perl-specific content.
12 
13## Taint Mode
14 
15- Use `-T` flag on all CGI/web-facing scripts
16- Sanitize `%ENV` (`$ENV{PATH}`, `$ENV{CDPATH}`, etc.) before any external command
17 
18## Input Validation
19 
20- Use allowlist regex for untainting — never `/(.*)/s`
21- Validate all user input with explicit patterns:
22 
23```perl
24if ($input =~ /\A([a-zA-Z0-9_-]+)\z/) {
25    my $clean = $1;
26}
27```
28 
29## File I/O
30 
31- **Three-arg open only** — never two-arg open
32- Prevent path traversal with `Cwd::realpath`:
33 
34```perl
35use Cwd 'realpath';
36my $safe_path = realpath($user_path);
37die "Path traversal" unless $safe_path =~ m{\A/allowed/directory/};
38```
39 
40## Process Execution
41 
42- Use **list-form `system()`** — never single-string form
43- Use **IPC::Run3** for capturing output
44- Never use backticks with variable interpolation
45 
46```perl
47system('grep', '-r', $pattern, $directory);  # safe
48```
49 
50## SQL Injection Prevention
51 
52Always use DBI placeholders — never interpolate into SQL:
53 
54```perl
55my $sth = $dbh->prepare('SELECT * FROM users WHERE email = ?');
56$sth->execute($email);
57```
58 
59## Security Scanning
60 
61Run **perlcritic** with the security theme at severity 4+:
62 
63```bash
64perlcritic --severity 4 --theme security lib/
65```
66 
67## Reference
68 
69See skill: `perl-security` for comprehensive Perl security patterns, taint mode, and safe I/O.
70