Bug #76174 for Digest-MD5-File: Digest::MD5::File

Fri Mar 30 15:29:49 2012 par.osterberg [...] gmail.com - Ticket created

CC:	dmuey [...] cpan.org
Subject:	Digest::MD5::File
Date:	Fri, 30 Mar 2012 15:29:39 -0400
To:	bug-Digest-MD5-File [...] rt.cpan.org
From:	Par Osterberg Medina <par.osterberg [...] gmail.com>

Daniel, First off let me start by thanking you for writing this excellent Perl module. Here is my system information; Package: libdigest-md5-file-perl Priority: optional Section: perl Installed-Size: 72 Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Architecture: all Version: 0.07-1 Depends: perl (>= 5.6.0-16), libwww-perl Linux xyz 2.6.32-5-amd64 #1 SMP Mon Jan 16 16:22:28 UTC 2012 x86_64 GNU/Linux This is perl, v5.10.1 (*) built for x86_64-linux-gnu-thread-multi I was messing around with Digest::MD5::File trying to get the module to accept a filename that ends with a space (0x20). Yes I know, a valid filename should not end with a space but I do not have any control over it - file is part of a self executing archive. They underlying issue is how you open the file in the function 'getfh' and by changing the 'open' statement on line 53 of 'File.pm' (see below) I was able to get it running; #open my ($fh), "$file" or return; open (my $fh,"<", $file) or return; Kind regards Pär Österberg Medina

Fri Mar 30 15:43:52 2012 dmuey [...] cpan.org - Correspondence added

thanks, I'll take a look ASAP

Fri Mar 30 15:43:53 2012 The RT System itself - Status changed from 'new' to 'open'

Sat Apr 07 14:32:34 2012 dmuey [...] cpan.org - Status changed from 'open' to 'resolved'

Sat Apr 07 14:32:35 2012 dmuey [...] cpan.org - Broken in 0.08 added

Sat Apr 07 14:34:41 2012 dmuey [...] cpan.org - Broken in 0.08 deleted

Sat Apr 07 14:34:41 2012 dmuey [...] cpan.org - Fixed in 0.08 added

Tue Jan 13 13:50:51 2015 christian [...] wetzig.de - Correspondence added

Subject:	[rt.cpan.org #76174] REOPEN
Date:	Tue, 13 Jan 2015 19:50:33 +0100
To:	bug-Digest-MD5-File [...] rt.cpan.org
From:	Christian Wetzig <christian [...] wetzig.de>

Hi Daniel, issue isn't fixed, module still uses two-argument open. Please fix, it's also a security problem. --- File.pm 2012-04-04 21:58:08.000000000 +0200 +++ File.pm.new 2015-01-13 19:13:44.000000000 +0100 @@ -50,7 +50,7 @@ my $getfh = sub { croak "$file: Is a directory" if -d $file && !$NOFATALS; if(-e $file && !-d $file) { - open my $fh, $file or return; + open my $fh, '<', $file or return; binmode $fh if $BINMODE; return $fh; } best regards, Christian

Tue Jan 13 15:07:13 2015 dmuey [...] cpan.org - Correspondence added

thanks, I'll try to address ASAP On Tue Jan 13 13:50:51 2015, christian@wetzig.de wrote: Show quoted text

> Hi Daniel, > > issue isn't fixed, module still uses two-argument open. > Please fix, it's also a security problem. > > --- File.pm 2012-04-04 21:58:08.000000000 +0200 > +++ File.pm.new 2015-01-13 19:13:44.000000000 +0100 > @@ -50,7 +50,7 @@ my $getfh = sub { > croak "$file: Is a directory" if -d $file && !$NOFATALS; > > if(-e $file && !-d $file) { > - open my $fh, $file or return; > + open my $fh, '<', $file or return; > binmode $fh if $BINMODE; > return $fh; > } > > > best regards, > Christian