Skip Menu |

This queue is for tickets about the w3mir CPAN distribution.

Report information
The Basics
Id: 29352
Status: new
Priority: 0/
Queue: w3mir

People
Owner: Nobody in particular
Requestors: rrauenza [...] cup.hp.com
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)



Subject: w3mir incorrectly uses absolute paths - possibility of overwriting files.
Date: Thu, 13 Sep 2007 16:02:00 -0700
To: bug-w3mir [...] rt.cpan.org
From: "Richard J. Rauenzahn" <rrauenza [...] cup.hp.com>
This could overwrite files in / !!! According to : http://lists.debian.org/debian-qa-packages/2005/04/msg00153.html This package has broken recently probably by an update to URI::URL, or whichever Perl module provides unix_path() When a URL is being requested and mirrored to disk, the unix_path is function is called with the full URL but this has recently changed which means the initial '/' is returned This means that the local filename to be used for saving the file is for example /index.html or /graphics/image.png which of course it can't save. The filename should be suitable for saving into the current directory. If this is not a bug in the newer version of URI::URL, then a simple fix is to add the following line at line number 588 $lf_name =~ s/^\///; ----------------------- Looks like this was fixed in Debian, except that other parts of w3mir are still broken. w3http.pm needs to be fixed in at least two other places as well, wherever there is a pattern of code like: my($lf_name) = (url "file:$lf_url")->unix_path; $lf_name =~ s/^\///; # new code to fix abs paths