| Subject: | Loading roles uses $_ in a very fragile way. |
The code Moo::Role uses to apply roles is this:
sub apply_roles_to_package {
my ($me, $to, @roles) = @_;
$me->_inhale_if_moose($_) for @roles;
$me->SUPER::apply_roles_to_package($to, @roles);
}
Within the for loop, global $_ is aliased to the individual roles in
the @roles array.
Now, _inhale_if_moose ultimately loads the role module if it's not
already been loaded. The role module (and any other modules that are
loaded by it) can alter $_ and thus alter the contents of the @roles
array which then gets passed to SUPER::apply_roles_to_package!
There is a minimal test case, plus a patch to fix Moo::Role attached.
Role::Tiny may also be vulnerable, but I've not checked.
| Subject: | moo-role-bug.tar.gz |
Message body not shown because it is not plain text.