| Subject: | parent.pm use of "require EXPR" is somewhat busted |
Given what parent.pm does, this is not a critical security issue (who is accepting arbitrary input
to parent->input??), but it's still a problem:
~$ cat > Bogus.pm
die "You are hosed."
~$ cd code
~/code$ perl -e 'use parent "../Bogus"'
You are hosed. at ../Bogus.pm line 1.
I have attached a patch, not for application, that proposes a first pass at a solution.
--
rjbs
| Subject: | 0003-WIP-use-Module-Load-instead-of-broken-string-eval.patch |
From bc05e62c1ab38831b2e8fdd232a0c9ca5d8bfcd0 Mon Sep 17 00:00:00 2001
From: Ricardo Signes <rjbs@cpan.org>
Date: Fri, 1 Feb 2013 10:34:44 -0500
Subject: [PATCH 3/3] WIP: use Module::Load instead of broken string eval
We should not use string eval to load classes, at least not without
validating them first:
~$ cat > Bogus.pm
die "You are hosed."
~$ cd code
~/code$ perl -e 'use parent "../Bogus"'
You are hosed. at ../Bogus.pm line 1.
We're not likely to be accepting untrusted input to "parent->import"
but nonetheless, this is no good. We should use something
well-tested, like Module::Load.
Unfortunately, Module::Load does not handle ' as a package
separator. This issue should be revisited.
---
lib/parent.pm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/parent.pm b/lib/parent.pm
index 6f3fe07..0503b72 100755
--- a/lib/parent.pm
+++ b/lib/parent.pm
@@ -28,10 +28,10 @@ sub import {
}
push @to_push, $name;
- $name =~ s{::|'}{/}g;
# dies if the file is not found
- require "$name.pm" unless $arg{no_require};
+ require Module::Load;
+ Module::Load::load($name) unless $arg{no_require};
$name->VERSION($arg{version}) if defined $arg{version};
}
--
1.8.1