| Subject: | uninitialized var from $ENV (was bug #14770) |
The changelog for version 2.31 says that bug #14770 is fixed ... but
it is badly fixed :
elsif ($this->{InterPolateEnv}) {
# may lead to vulnerabilities, by default flag turned off
$con . $ENV{$var};
if (defined($ENV{$var})) {
$con . $ENV{$var};
}
}
should really be
elsif ($this->{InterPolateEnv}) {
# may lead to vulnerabilities, by default flag turned off
if (defined($ENV{$var})) {
$con . $ENV{$var};
}
}
(suppress line 94).
Additionally, ticket 14770 should be closed in RT.
Thanks, L. Dami