Subject: | w3mir incorrectly uses absolute paths - possibility of overwriting files. |
Date: | Thu, 13 Sep 2007 16:02:00 -0700 |
To: | bug-w3mir [...] rt.cpan.org |
From: | "Richard J. Rauenzahn" <rrauenza [...] cup.hp.com> |
This could overwrite files in / !!!
According to :
http://lists.debian.org/debian-qa-packages/2005/04/msg00153.html
This package has broken recently probably by an update
to URI::URL, or whichever Perl module provides unix_path()
When a URL is being requested and mirrored to disk,
the unix_path is function is called with the full URL
but this has recently changed which means the initial
'/' is returned
This means that the local filename to be used for saving
the file is for example /index.html or /graphics/image.png
which of course it can't save. The filename should be suitable
for saving into the current directory.
If this is not a bug in the newer version of URI::URL, then
a simple fix is to add the following line at line number 588
$lf_name =~ s/^\///;
-----------------------
Looks like this was fixed in Debian, except that other parts of w3mir
are still broken. w3http.pm needs to be fixed in at least two other
places as well, wherever there is a pattern of code like:
my($lf_name) = (url "file:$lf_url")->unix_path;
$lf_name =~ s/^\///; # new code to fix abs paths