- untaint environment

lib/SLUB/LZA/Rosetta/TA.pm

@@ -20,7 +20,13 @@ our %cache;
 our $cache_path;
 our $SALT = pack("H16", "There is no security by obscurity!");
 BEGIN {
-    my $home = path($ENV{'HOME'});
+    my $rx_psep = qr{[/\\]};
+    my $rx_abs  = qr{[A-Z]:};
+    my $rx_sub  = qr{([[:print:]]+)};
+    $ENV{'HOME'} =~ m{^(($rx_abs)?($rx_psep$rx_sub)+)$}m;
+    # untaint $homestr
+    my $homestr = $1;
+    my $home = path($homestr);
     if ($home->is_dir() && !$home->is_rootdir) {
         my $config_path = $home->child('.config')->child('ta-tool.rc');
         our $config_file = $config_path;
@@ -36,6 +42,7 @@ BEGIN{
             %cache = YAML::LoadFile($cache_path);
         }
     }
+
 }
 
 END {