lib/CGI/Session.pm | 4 4 + 0 - 0 !
t/taint_storage.t | 34 34 + 0 - 0 !
2 files changed, 38 insertions(+)

 [patch] untaint raw data coming from session storage backends

The various storage backends need to be considered trusted,
so data coming out of them should be untainted.

The _CLAIMED_ID comes from an HTTP cookie and is probably tainted,
but presumably it's OK if it matched some data in the storage.

Bug: https://rt.cpan.org/Public/Bug/Display.html?id=80346
Bug-Debian: https://bugs.debian.org/810799