Bug #105405 for Apache-AuthCookie: CGI version 4.20 issues 'CGI::param called in list context' warnings

Mon Jun 22 12:39:13 2015 jamesnelson [...] acuitymanagement.com - Ticket created

Subject:	CGI version 4.20 issues 'CGI::param called in list context' warnings
Date:	Mon, 22 Jun 2015 16:38:26 +0000
To:	"bug-Apache-AuthCookie [...] rt.cpan.org" <bug-Apache-AuthCookie [...] rt.cpan.org>
From:	James Nelson <jamesnelson [...] acuitymanagement.com>

OS: CentOS 6.6 x86-64 Perl version: 5.10.1 Apache2::AuthCookie version: 3.22 On upgrading our production servers to CentOS 6, we started getting the following log messages: CGI::param called in list context from /usr/local/share/perl5/Apache2/AuthCookie.pm line 127, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 404 Per this article: http://www.perlmonks.org/?node_id=1105051, setting $CGI::LIST_CONTEXT_WARN = 0 will suppress the warnings, but it will need to be fixed going forward.

Mon Jun 22 16:44:10 2015 MSCHOUT [...] cpan.org - Correspondence added

Its worth nothing that in this case, the code calling param() *EXPECTS* a list in response, so this code is not vulnerable. I should probably find something other than CGI.pm to handle the params. The only reason I went with CGI.pm in the first place was to avoid adding a dependency on yet another module. But since CGI.pm is gone now in 5.22 that argument does not apply in the future.

Mon Jun 22 16:44:11 2015 The RT System itself - Status changed from 'new' to 'open'

Tue Jun 23 03:25:12 2015 SREZIC [...] cpan.org - Correspondence added

On 2015-06-22 16:44:10, MSCHOUT wrote: Show quoted text

> Its worth nothing that in this case, the code calling param() > *EXPECTS* a list in response, so this code is not vulnerable.

In this case you can use the new function multi_param() if it's available. To be compatible with older CGI.pm you could do something like this (untested): if (!defined &CGI::multi_param) { *CGI::multi_param = \&CGI::param; }

Thu Sep 10 11:04:54 2015 MSCHOUT [...] cpan.org - Correspondence added

I have committed a fix for this to git for the next release. I am working on finalizing support for apache 2.4 which I also want to put in this release so I have not yet uploaded it to CPAN FYI.

Thu Sep 10 11:04:55 2015 MSCHOUT [...] cpan.org - Status changed from 'open' to 'patched'

Tue Feb 14 16:33:22 2017 MSCHOUT [...] cpan.org - Correspondence added

Marking this as resolved since AuthCookie no longer uses CGI.pm -- Regards, Michael Schout

Tue Feb 14 16:33:22 2017 MSCHOUT [...] cpan.org - Status changed from 'patched' to 'resolved'