Bug #95478 for SHARYANTO-Utils: Uses File::Slurp, known to be buggy and vulnerable

Thu May 08 18:22:58 2014 ether [...] cpan.org - Ticket created

Subject:

Uses File::Slurp, known to be buggy and vulnerable

e.g. look at https://rt.cpan.org/Ticket/Display.html?id=83126 and be dismayed Path::Slurp::Tiny and Path::Tiny are both excellent alternatives.

Fri May 09 03:58:00 2014 sharyanto [...] cpan.org - Correspondence added

On Thu May 08 18:22:58 2014, ETHER wrote: Show quoted text

> e.g. look at https://rt.cpan.org/Ticket/Display.html?id=83126 and be > dismayed > > Path::Slurp::Tiny and Path::Tiny are both excellent alternatives.

Thanks. I have 55 dists that use File::Slurp. I'll bite the bullet and do a mass migration. Regards, Steven

Fri May 09 03:58:01 2014 The RT System itself - Status changed from 'new' to 'open'

Fri May 09 04:17:34 2014 sharyanto [...] cpan.org - Correspondence added

On Fri May 09 03:58:00 2014, SHARYANTO wrote: Show quoted text

> On Thu May 08 18:22:58 2014, ETHER wrote:

> > e.g. look at https://rt.cpan.org/Ticket/Display.html?id=83126 and be > > dismayed > > > > Path::Slurp::Tiny and Path::Tiny are both excellent alternatives.

> > Thanks. > > I have 55 dists that use File::Slurp. I'll bite the bullet and do a > mass migration.

On second thought, I use 'err_mode' in several places and File::Slurp::Tiny doesn't support it yet (submitted an RT ticket on that). Path::Tiny has a totally different API (and I still prefer the File::Slurp-style API). So I'll pend on this one first. BTW, I use File::Slurp mostly in test scripts. Regards, Steven

Fri May 09 12:34:58 2014 rt-cpan [...] trout.me.uk - Correspondence added

On Fri May 09 04:17:34 2014, SHARYANTO wrote: Show quoted text

> On second thought, I use 'err_mode' in several places and > File::Slurp::Tiny doesn't support it yet (submitted an RT ticket on > that). Path::Tiny has a totally different API (and I still prefer the > File::Slurp-style API). So I'll pend on this one first.

err_mode is one of the mistakes in the File::Slurp API; don't expect it to be duplicated in the replacements. You should replace it with a try/catch or eval and be explicit about what you're doing with the error.

Fri May 09 12:52:29 2014 sharyanto [...] cpan.org - Correspondence added

On Fri May 09 12:34:58 2014, MSTROUT wrote: Show quoted text

> On Fri May 09 04:17:34 2014, SHARYANTO wrote:

> > On second thought, I use 'err_mode' in several places and > > File::Slurp::Tiny doesn't support it yet (submitted an RT ticket on > > that). Path::Tiny has a totally different API (and I still prefer the > > File::Slurp-style API). So I'll pend on this one first.

> > err_mode is one of the mistakes in the File::Slurp API; don't expect > it to be duplicated in the replacements. > > You should replace it with a try/catch or eval and be explicit about > what you're doing with the error.

I don't agree/disagree with 'err_mode' being a mistake. But from the API user's point of view, I think it already lets me be explicit and straightforward about how to handle the error (err_mode=>'quiet' "I want to ignore errors", etc). Regards, Steven

Fri May 09 12:58:15 2014 rt-cpan [...] trout.me.uk - Correspondence added

On Fri May 09 12:52:29 2014, SHARYANTO wrote: Show quoted text

> I don't agree/disagree with 'err_mode' being a mistake. But from the > API user's point of view, I think it already lets me be explicit and > straightforward about how to handle the error (err_mode=>'quiet' "I > want to ignore errors", etc).

I fail to see how a module-specific piece of wierd shit is any more straightforward than my $data = try { read_file($file) }; Of course, I'd write that as use IO::All; my $data = try { io->file($file)->all }; but I figure if you're still on prehistoric shit like File::Slurp you're probably not going to like IO::All's actually-having-features-ness :)

Fri May 09 13:24:21 2014 sharyanto [...] cpan.org - Correspondence added

On Fri May 09 12:58:15 2014, MSTROUT wrote: Show quoted text

> On Fri May 09 12:52:29 2014, SHARYANTO wrote:

> > I don't agree/disagree with 'err_mode' being a mistake. But from the > > API user's point of view, I think it already lets me be explicit and > > straightforward about how to handle the error (err_mode=>'quiet' "I > > want to ignore errors", etc).

> > I fail to see how a module-specific piece of wierd shit is any more > straightforward than > > my $data = try { read_file($file) }; > > Of course, I'd write that as > > use IO::All; > my $data = try { io->file($file)->all }; > > but I figure if you're still on prehistoric shit like File::Slurp > you're probably not going to like IO::All's actually-having-features- > ness :)

Nah, IO::All's too cute. I'm still on the good ol' functional bandwagon most of the time (which some might call prehistoric) :-p I'll be replacing err_mode with eval { }, BTW. Thanks all, Steven

Fri May 09 13:24:21 2014 sharyanto [...] cpan.org - Status changed from 'open' to 'resolved'

Fri May 09 13:33:05 2014 rt-cpan [...] trout.me.uk - Correspondence added

On Fri May 09 13:24:21 2014, SHARYANTO wrote: Show quoted text

> Nah, IO::All's too cute. I'm still on the good ol' functional > bandwagon most of the time (which some might call prehistoric) :-p

Thought so, not going to argue it :) Show quoted text

> I'll be replacing err_mode with eval { }, BTW.

Thanks.

Mon May 12 13:31:29 2014 ether [...] cpan.org - Correspondence added

On 2014-05-08 15:22:58, ETHER wrote: Show quoted text

> e.g. look at https://rt.cpan.org/Ticket/Display.html?id=83126 and be > dismayed > > Path::Slurp::Tiny and Path::Tiny are both excellent alternatives.

oops s/Path::Slurp::Tiny/File::Slurp::Tiny/ sorry