| Subject: | Parsing tainted strings in Perl 5.16.3 |
May I have a question what's version attitude to parsing tainted strings? This code:
#!/usr/bin/perl -Tw
use version;
$ENV{PATH}='/usr/bin';
$a=`echo 1.2.3`;
chomp $a;
print version->new($a), qq{\n};
works fine since perl v5.17.1-386-g4bac9ae (i.e. prints "1.2.3"), but with older perls (5.16.x and older) it either returns empty string (since version-0.9908) or croaks about "Invalid version format (non-numeric data)" (up to version-0.9907). (The change in version responsible for not croaking is mercurial commit efb44fbc6bd8 (Deal with certain tiedscalars (e.g. created by Readonly::XS).)
Does not make sense for the version module to accept tainted input? If it does, would it be possible to change vutil.c so that it works even with perl 5.16 older?
To make things more complicated, only the XS implementation is affected. The pure-perl version accepts tainted strings everywhere.