Bug #45885 for File-Temp: Fails under -T, perl 5.6.2, FreeBSD

Sat May 09 00:32:20 2009 burak [...] cpan.org - Ticket created

Subject:

Fails under -T, perl 5.6.2, FreeBSD

I got this failure caused by File::Temp under tain mode for my module: http://www.nntp.perl.org/group/perl.cpan.testers/2009/05/msg3832762.html The tests in question only has this line related: my $TEMPDIR = tempdir( CLEANUP => 1 ); Seems to be some edge case in an old perl.

Mon Jun 29 01:38:59 2009 TJENNESS [...] cpan.org - Correspondence added

On Sat May 09 00:32:20 2009, BURAK wrote: Show quoted text

> I got this failure caused by File::Temp under tain mode for my module: > http://www.nntp.perl.org/group/perl.cpan.testers/2009/05/msg3832762.html > > The tests in question only has this line related: > > my $TEMPDIR = tempdir( CLEANUP => 1 ); > > Seems to be some edge case in an old perl.

This is very strange because cpan-testers shows no fails on freebsd for File::Temp with perl 5.6.2. I'm not sure what to say unless the person whose box reported that failure digs a bit deeper into why $path is tainted on their platform. Tim

Mon Jun 29 01:38:59 2009 The RT System itself - Status changed from 'new' to 'open'

Fri Dec 16 21:26:33 2011 TJENNESS [...] cpan.org - Correspondence added

Closing this as it does seem to work on OSX and Linux with perl 5.8.x (unable to test with 5.6.2 on FreeBSD at this time).

Fri Dec 16 21:26:34 2011 TJENNESS [...] cpan.org - Status changed from 'open' to 'resolved'

Sat Dec 17 01:49:04 2011 $_ = 'spro^^*%*^6ut# [...] &$%*c>#!^!#&!pan.org'; y/a-z.@//cd; print - Correspondence added

On Fri Dec 16 21:26:33 2011, TJENNESS wrote: Show quoted text

> Closing this as it does seem to work on OSX and Linux with perl 5.8.x > (unable to test with 5.6.2 > on FreeBSD at this time).

I can reproduce it on OS X with 5.6.2. File::Temp is using File::Spec->tmpdir. As of version 0.84 it tries to avoid returning a tainted tmpdir under tainting. 5.6 doesn’t have the ${^TAINT} variable, so under that version it gives up. File::Spec could use eval('1'.substr $tmpdir,0,0) to see whether a path it is about to return is safe, at least on older versions. Now I need to open a File::Spec bug.... Actually, it’s in perl’s own repository, so maybe I can patch it directly. :-)

Sat Dec 17 01:49:06 2011 The RT System itself - Status changed from 'resolved' to 'open'

Sat Dec 17 02:29:07 2011 $_ = 'spro^^*%*^6ut# [...] &$%*c>#!^!#&!pan.org'; y/a-z.@//cd; print - Correspondence added

RT-Send-CC:

smueller [...] cpan.org

On Sat Dec 17 01:49:04 2011, SPROUT wrote: Show quoted text

> On Fri Dec 16 21:26:33 2011, TJENNESS wrote:

> > Closing this as it does seem to work on OSX and Linux with perl

> 5.8.x

> > (unable to test with 5.6.2 > > on FreeBSD at this time).

> > I can reproduce it on OS X with 5.6.2. File::Temp is using > File::Spec->tmpdir. As of version > 0.84 it tries to avoid returning a tainted tmpdir under tainting. 5.6 > doesn’t have the ${^TAINT} > variable, so under that version it gives up. File::Spec could use > eval('1'.substr $tmpdir,0,0) to > see whether a path it is about to return is safe, at least on older > versions. Now I need to open a > File::Spec bug.... > > Actually, it’s in perl’s own repository, so maybe I can patch it > directly. :-)

This has been fixed here: http://perl5.git.perl.org/perl.git/commitdiff/63a0dcf71 But I don’t know when the next PathTools release will be.

Fri Dec 23 22:30:57 2011 $_ = 'spro^^*%*^6ut# [...] &$%*c>#!^!#&!pan.org'; y/a-z.@//cd; print - Correspondence added

On Sat Dec 17 02:29:07 2011, SPROUT wrote: Show quoted text

> On Sat Dec 17 01:49:04 2011, SPROUT wrote:

> > On Fri Dec 16 21:26:33 2011, TJENNESS wrote:

> > > Closing this as it does seem to work on OSX and Linux with perl

> > 5.8.x

> > > (unable to test with 5.6.2 > > > on FreeBSD at this time).

> > > > I can reproduce it on OS X with 5.6.2. File::Temp is using > > File::Spec->tmpdir. As of version > > 0.84 it tries to avoid returning a tainted tmpdir under tainting.

> 5.6

> > doesn’t have the ${^TAINT} > > variable, so under that version it gives up. File::Spec could use > > eval('1'.substr $tmpdir,0,0) to > > see whether a path it is about to return is safe, at least on older > > versions. Now I need to open a > > File::Spec bug.... > > > > Actually, it’s in perl’s own repository, so maybe I can patch it > > directly. :-)

> > This has been fixed here: > http://perl5.git.perl.org/perl.git/commitdiff/63a0dcf71 > > But I don’t know when the next PathTools release will be.

A dev release of PathTools, SMUELLER/PathTools-3.39_01.tar.gz, has just made its way to CPAN.

Wed Feb 06 17:54:51 2013 dagolden [...] cpan.org - Correspondence added

Show quoted text

> > But I don’t know when the next PathTools release will be.

> > A dev release of PathTools, SMUELLER/PathTools-3.39_01.tar.gz, has just > made its way to CPAN.

PathTools-3.40 was released Jan 16, 2013. Is it sufficient to make File::Temp depend on that? And FWIW, I think 5.6 is so far out of the support window for Perl 5 that I wouldn't worry about it any more.

Wed Feb 06 20:58:03 2013 dagolden [...] cpan.org - Correspondence added

On reflection, I'm closing this ticket. Perl 5.6.2 is not a supported Perl and I don't see File::Temp adding latest PathTools as a prereq just to support it.

Wed Feb 06 20:58:04 2013 dagolden [...] cpan.org - Status changed from 'open' to 'resolved'