Skip Menu |

This queue is for tickets about the URI-Escape-XS CPAN distribution.

Report information
The Basics
Id: 39344
Status: resolved
Priority: 0/
Queue: URI-Escape-XS

People
Owner: Nobody in particular
Requestors: bitcard.org [...] illusori.co.uk
Cc:
AdminCc:

Bug Information
Severity: Critical
Broken in: 0.02
Fixed in: (no value)



Subject: Unsafe string arg assumption
uri_escape() at the least assumes a string for an argument, it can get very confused when supplied a numeric argument, simple test case on perl 5.10.0: $ perl -MURI::Escape::XS -e 'foreach ( "frog", 1, "emu", 12 ) { print URI::Escape::XS:: uri_escape( $_ ), "\n"; }' frog 1%00og emu 12%00 As you can see it's overrunning the var. A workaround within the calling code is to force the arg into a string via interpolation such as: $ perl -MURI::Escape::XS -e 'foreach ( "frog", 1, "emu", 12 ) { print URI::Escape::XS:: uri_escape( "$_" ), "\n"; }' frog 1 emu 12 Seems to me that overruning the end of vars is probably a fairly critical bug though. :) uname -a: Linux *** 2.6.25-2-686 #1 SMP Fri Jul 18 17:46:56 UTC 2008 i686 GNU/Linux Linux distro: debian unstable
Thanks. Fixed in 0.03. Dan the Maintainer Thereof diff -u -r0.2 lib/URI/Escape/XS.pm --- lib/URI/Escape/XS.pm 2008/05/31 00:00:32 0.2 +++ lib/URI/Escape/XS.pm 2009/01/16 06:38:57 @@ -1,11 +1,11 @@ package URI::Escape::XS; # -# $Id: XS.pm,v 0.2 2008/05/31 00:00:32 dankogai Exp $ +# $Id: XS.pm,v 0.3 2009/01/16 06:38:52 dankogai Exp dankogai $ # use 5.008001; use warnings; use strict; -our $VERSION = sprintf "%d.%02d", q$Revision: 0.2 $ =~ /(\d+)/g; +our $VERSION = sprintf "%d.%02d", q$Revision: 0.3 $ =~ /(\d+)/g; use base qw(Exporter); our @EXPORT = qw(encodeURIComponent decodeURIComponent); @@ -25,8 +25,10 @@ my %escapes = map { chr($_) => sprintf("%%%02X", $_) } (0..255); my %regexp; sub uri_escape { - my($text, $patn) = @_; + return unless @_; + my ($text, $patn) = @_; return undef unless defined $text; + $text .= ''; # RT#39344 -- force string if (defined $patn){ unless (exists $regexp{$patn}){ my $re; @@ -56,7 +58,7 @@ =head1 VERSION -$Id: XS.pm,v 0.2 2008/05/31 00:00:32 dankogai Exp $ +$Id: XS.pm,v 0.3 2009/01/16 06:38:52 dankogai Exp dankogai $ =cut On Tue Sep 16 21:41:46 2008, illusori wrote: Show quoted text
> uri_escape() at the least assumes a string for an argument, it can get > very confused when > supplied a numeric argument, simple test case on perl 5.10.0: > > $ perl -MURI::Escape::XS -e 'foreach ( "frog", 1, "emu", 12 ) { print > URI::Escape::XS:: > uri_escape( $_ ), "\n"; }' > frog > 1%00og > emu > 12%00 > > As you can see it's overrunning the var. > > A workaround within the calling code is to force the arg into a string > via interpolation such > as: > > $ perl -MURI::Escape::XS -e 'foreach ( "frog", 1, "emu", 12 ) { print > URI::Escape::XS:: > uri_escape( "$_" ), "\n"; }' > frog > 1 > emu > 12 > > Seems to me that overruning the end of vars is probably a fairly > critical bug though. :) > > uname -a: Linux *** 2.6.25-2-686 #1 SMP Fri Jul 18 17:46:56 UTC 2008 > i686 GNU/Linux > Linux distro: debian unstable