Skip Menu |

This queue is for tickets about the Module-Metadata CPAN distribution.

Maintainer(s)' notes

Attention bug reporters: issues MUST include the version of Module::Metadata that you are running that exhibit the stated symptoms. thank you!

Report information
The Basics
Id: 88576
Status: resolved
Priority: 0/
Queue: Module-Metadata
People
Owner: ether [...] cpan.org
Requestors: BINGOS [...] cpan.org
Cc:
AdminCc:
Bug Information
Severity: Important
Broken in: 1.000016
Fixed in: 1.000019

History Show all quoted text
  Tue Sep 10 06:57:07 2013 BINGOS [...] cpan.org - Ticket created
Subject: Does not work with taint
Module::Metadata fails when taint is enabled. Without taint: ============== $ perl -MModule::Metadata -E 'say Module::Metadata->new_from_module( "Module::Metadata" )->version' 1.000016 With taint: =========== $ perl -T -MModule::Metadata -E 'say Module::Metadata->new_from_module( "Module::Metadata" )->version' Insecure dependency in eval while running with -T switch at /opt/perl-5.18.1/lib/site_perl/5.18.1/Module/Metadata.pm line 667, <GEN0> line 14. EUMM's MM->parse_version suffers the same problem. See also RT#88567
  Tue Sep 10 07:09:46 2013 BINGOS [...] cpan.org - Correspondence added
On Tue Sep 10 06:57:07 2013, BINGOS wrote: Show quoted text
> > EUMM's MM->parse_version suffers the same problem. > > See also RT#88567
I have just committed a change to EUMM in the following change that resolves the issue in EUMM: https://github.com/Perl-Toolchain-Gang/ExtUtils-MakeMaker/commit/5860c0643496cc4d5e047874a3a8a4e4b4d3449d Cheers.
  Tue Sep 10 13:37:43 2013 BINGOS [...] cpan.org - Correspondence added
On Tue Sep 10 07:09:46 2013, BINGOS wrote: Show quoted text
> On Tue Sep 10 06:57:07 2013, BINGOS wrote:
> > > > EUMM's MM->parse_version suffers the same problem. > > > > See also RT#88567
> > I have just committed a change to EUMM in the following change that > resolves the issue in EUMM: > > https://github.com/Perl-Toolchain-Gang/ExtUtils- > MakeMaker/commit/5860c0643496cc4d5e047874a3a8a4e4b4d3449d > > Cheers.
And here's a patch: diff --git a/lib/Module/Metadata.pm b/lib/Module/Metadata.pm index d979932..6a1f74a 100644 --- a/lib/Module/Metadata.pm +++ b/lib/Module/Metadata.pm @@ -663,6 +663,8 @@ sub _evaluate_version_line { }; }}; + $eval = $1 if $eval =~ m{^(.+)}s; + local $^W; # Try to get the $VERSION eval $eval;
  Tue Sep 10 14:03:23 2013 ether [...] cpan.org - Status changed from 'new' to 'patched'
  Tue Sep 10 14:03:23 2013 ether [...] cpan.org - Taken
  Tue Sep 10 16:04:43 2013 ether [...] cpan.org - Correspondence added
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=722210 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=717213
  Tue Sep 10 20:58:01 2013 ether [...] cpan.org - Correspondence added
Patched in branch topic/taint, but the test fails when running via 'make test' (but not via perl -Ilib -T t/taint).. sorting that out before releasing.
  Tue Sep 10 21:05:14 2013 ether [...] cpan.org - Correspondence added
POSTing upload for Module-Metadata-1.000017.tar.gz to http://pause.perl.org/pause/authenquery PAUSE add message sent ok [200]
  Tue Sep 10 21:05:15 2013 ether [...] cpan.org - Status changed from 'patched' to 'resolved'
  Wed Sep 11 05:15:52 2013 paul [...] city-fan.org - Correspondence added
From: paul [...] city-fan.org
On Tue Sep 10 21:05:14 2013, ETHER wrote: Show quoted text
> POSTing upload for Module-Metadata-1.000017.tar.gz to > http://pause.perl.org/pause/authenquery > PAUSE add message sent ok [200]
The new t/taint.t test added in this release has a test dependency of Test::Fatal that's not declared in META.*.
  Wed Sep 11 05:27:38 2013 paul [...] city-fan.org - Correspondence added
From: paul [...] city-fan.org
On Wed Sep 11 05:15:52 2013, paul@city-fan.org wrote: Show quoted text
> On Tue Sep 10 21:05:14 2013, ETHER wrote:
> > POSTing upload for Module-Metadata-1.000017.tar.gz to > > http://pause.perl.org/pause/authenquery > > PAUSE add message sent ok [200]
> > The new t/taint.t test added in this release has a test dependency of > Test::Fatal that's not declared in META.*.
Just noticed that the dependency on Test::More 0.88 (for done_testing) isn't there either...
  Wed Sep 11 12:04:05 2013 ether [...] cpan.org - Correspondence added
Subject: Re: [rt.cpan.org #88576] Does not work with taint
Date: Wed, 11 Sep 2013 09:03:53 -0700
To: "paul [...] city-fan.org via RT" <bug-Module-Metadata [...] rt.cpan.org>
From: Karen Etheridge <ether [...] cpan.org>
On Wed, Sep 11, 2013 at 05:15:54AM -0400, paul@city-fan.org via RT wrote: Show quoted text
> The new t/taint.t test added in this release has a test dependency of Test::Fatal that's not declared in META.*.
Doh, I'm too used to prereqs being added to metadata automatically. Curse you, Dist::Zilla! will fix (and remove the use of Test::Fatal, as others have commented about the use of non-core prereqs).
  Wed Sep 11 12:30:12 2013 ether [...] cpan.org - Correspondence added
On 2013-09-11 09:04:05, ETHER wrote: Show quoted text
> Doh, I'm too used to prereqs being added to metadata automatically. > Curse > you, Dist::Zilla! will fix (and remove the use of Test::Fatal, as > others > have commented about the use of non-core prereqs).
1.000018 has been uploaded.
  Wed Sep 11 13:07:00 2013 paul [...] city-fan.org - Correspondence added
From: paul [...] city-fan.org
On Wed Sep 11 12:30:12 2013, ETHER wrote: Show quoted text
> On 2013-09-11 09:04:05, ETHER wrote: >
> > Doh, I'm too used to prereqs being added to metadata automatically. > > Curse > > you, Dist::Zilla! will fix (and remove the use of Test::Fatal, as > > others > > have commented about the use of non-core prereqs).
> > 1.000018 has been uploaded.
Still doesn't list *any* test dependencies (e.g. Test::More, Carp, lib) in META.*... is that intentional because they're all core modules?
  Wed Sep 11 13:45:42 2013 ether [...] cpan.org - Correspondence added
Subject: Re: [rt.cpan.org #88576] Does not work with taint
Date: Wed, 11 Sep 2013 10:45:27 -0700
To: "paul [...] city-fan.org via RT" <bug-Module-Metadata [...] rt.cpan.org>
From: Karen Etheridge <ether [...] cpan.org>
On Wed, Sep 11, 2013 at 01:07:00PM -0400, paul@city-fan.org via RT wrote: Show quoted text
> Still doesn't list *any* test dependencies (e.g. Test::More, Carp, lib) in META.*... is that intentional because they're all core modules?
I expect so. Since this is a dual-life module, it should have no non-core prereqs. I have added these to the metadata however, for the next release (whenever that might be).
  Thu Oct 23 18:35:04 2014 ether [...] cpan.org - Fixed in 1.000019 added