| CC: | Christian Hansen <ch [...] ngmedia.com> |
| Subject: | WWW::Mechanize::CGI::cgi_application($app) doesn't work with path with embedded spaces |
| Date: | Wed, 11 Jun 2008 19:28:09 +0200 |
| To: | bug-WWW-Mechanize-CGI [...] rt.cpan.org |
| From: | Jakub Narebski <jnareb [...] gmail.com> |
WWW::Mechanize::CGI::cgi_application($app) doesn't work with path which
contains embedded spaces. This is caused by the fact that parameter of
cgi_application is passed directly and without any quoting to system();
and system() splits it on whitespace:
If there are no shell metacharacters in the argument, it is
split into words and passed directly to "execvp", which is more
efficient.
Quoting argument to cgi_application doesn't work, because a) if passed
filename is absolute, then File::Spec->is_absolute() doesn't consider
then filename absolute and WWW::Mechanize::CGI mangles it, b) if passed
filename is relative, quotes go in the middle of converted to absolute
pathname.
I think that it should be safe to pass $app to system call surrounded
with quotes, as it is meant to be path to executable file, i.e. single
command and not command with arguments.
Steps to reproduce:
===================
use CGI;
use WWW::Mechanize::CGI;
# Using a external CGI application
$mech = WWW::Mechanize::CGI->new;
$mech->cgi_application('/path/with spaces/cgi-bin.cgi');
$mech = WWW::Mechanize::CGI->new;
$mech->cgi_application("'/path/with spaces/cgi-bin.cgi'");
Version info:
=============
* WWW-Mechanize-CGI-0.3
* perl, v5.8.6
* Linux roke 2.6.14-11.1.aur.2 i686 athlon i386 GNU/Linux
Proposed patch:
===============
diff -u a/WWW/Mechanize/CGI.pm b/WWW/Mechanize/CGI.pm
--- a/WWW/Mechanize/CGI.pm
+++ b/WWW/Mechanize/CGI.pm
@@ -46,7 +46,7 @@ cgi_application
my $cgi = sub {
- my $status = system($application);
+ my $status = system("'$application'");
my $value = $status >> 8;
if ( $status == -1 ) {
P.S. Cc-ed author of this module, namely Christian Hansen.
--
Jakub Narebski
Poland