Your question is not really related to taint mode. You set
$ENV{PATH}="/usr/bin:/bin:/sbin:/usr/sbin";
These directories do not normally exist on a Windows machine. dir
is a cmd.exe internal command so to be able to execute that, you need to add the directory where it resides to the path.
Now, note that the way you go about doing it contradicts the whole point of setting the path to known definite locations. It is definitely possible for a nefarious user to change this environment variable to point to his dangerous version of dir
.
The fact that Windows is not necessarily installed in C:\Windows complicates writing a taint-safe script on Windows if you rely on any of the shell builtins.
EDIT: Here is a short test program you can use as a baseline:
#!/usr/bin/perl -T
use strict;
use warnings;
$ENV{PATH} = join(';', qw(C:\Windows C:\Windows\System32) );
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};
open my $pipe_h, '-|', 'dir'
or die "Cannot open pipe to dir: $!";
print while <$pipe_h>;
close $pipe_h
or die "Cannot close pipe to dir: $!";
__END__
C:\Temp> perl -T v.pl
...
2009/05/25 08:58 AM 3,584 zzz.exe
64 File(s) 32,125,365 bytes
14 Dir(s) 39,251,894,272 bytes free
Basically, what you need is for the system administrator to hardcode the acceptable path at installation time and for untrusted users not to have write permissions on the script.