Blindly detainting it defeats the purpose of Perl making this check to begin with. I'm pretty sure everything we shell out to (including send mail) is done with an explicit path, so the content of PATH is irrelevant even if it's invalid. So just seeing it to /bin or something should be plenty.
Bug 1923778 Comment 3 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
Blindly detainting it defeats the purpose of Perl making this check to begin with. I'm pretty sure everything we shell out to (including send mail) is done with an explicit path, so the content of PATH is irrelevant even if it's invalid. So just setting it to /bin or something should be plenty.