| Subject: | multi_param warning |
| Date: | Wed, 25 Mar 2015 10:24:31 +0000 |
| To: | bug-WWW-Mechanize [...] rt.cpan.org |
| From: | Zefram <zefram [...] fysh.org> |
With recent CGI.pm, WWW-Mechanize generates these warnings from its
test suite:
CGI::param called in list context from package main
/opt/perl-5.20.2/cpan/build/WWW-Mechanize-1.74-x1I0dt/t/local/log-server
line 112, this can lead to vulnerabilities. See the warning in
"Fetching the value or values of a single named parameter" at
/opt/perl-5.20.2/cpan/build/WWW-Mechanize-1.74-x1I0dt/CGI.pm line 437,
<DATA> line 39.
The attached patch alters the method call to avoid the warning. The fix
depends on the new multi_param method, so the patch also declares a
dependency on the first version of CGI that contained that method.
This incidentally fixes the bug that WWW-Mechanize doesn't declare its
dependency on CGI at all, which is potentially a problem now that CGI.pm
is no longer bundled with the Perl core.
-zefram
Message body is not shown because sender requested not to inline it.