Bug #98795 for Test-Kwalitee: Testing fails if test is run with taint checking switched on

Thu Sep 11 11:29:22 2014 abe [...] deuxchevaux.org - Ticket created

Subject:	Testing fails if test is run with taint checking switched on
Date:	Thu, 11 Sep 2014 17:29:08 +0200
To:	bug-Test-Kwalitee [...] rt.cpan.org
From:	Axel Beckert <abe [...] deuxchevaux.org>

Hi, please consider the following as a nice-to-have wishlist item and not as a bug. A test with Test::Kwalitee as documented in POD fails as follows if run with taint checking switched on: t/kwalitee.t ............... 1/? Insecure dependency in chdir while running with -T switch at /usr/share/perl/5.20/File/Find.pm line 684. # Tests were run but no plan was declared and done_testing() was not seen. # Looks like your test exited with 255 just after 2. t/kwalitee.t ............... Dubious, test returned 255 (wstat 65280, 0xff00) It works as expected again if I switch off taint checking again. (Noticed it because all other tests in the distribution have a shebang line with "#!perl -T" so I added it to t/kwalitee.t, too.) The version of Test::Kwalitee is 1.22, the version of Perl is 5.20.0. Kind regards, Axel -- /~\ Plain Text Ribbon Campaign | Axel Beckert \ / Say No to HTML in E-Mail and News | abe@deuxchevaux.org (Mail) X See http://www.nonhtmlmail.org/campaign.html | abe@noone.org (Mail+Jabber) / \ I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

Thu Sep 11 11:51:56 2014 ether [...] cpan.org - Severity Wishlist added

Thu Sep 11 12:21:31 2014 ether [...] cpan.org - Correspondence added

Subject:	Re: [rt.cpan.org #98795] Testing fails if test is run with taint checking switched on
Date:	Thu, 11 Sep 2014 09:21:06 -0700
To:	Axel Beckert via RT <bug-Test-Kwalitee [...] rt.cpan.org>
From:	Karen Etheridge <ether [...] cpan.org>

On Thu, Sep 11, 2014 at 11:29:22AM -0400, Axel Beckert via RT wrote: Show quoted text

> please consider the following as a nice-to-have wishlist item and not > as a bug. > > A test with Test::Kwalitee as documented in POD fails as follows if > run with taint checking switched on: > > t/kwalitee.t ............... 1/? Insecure dependency in chdir while running with -T switch at /usr/share/perl/5.20/File/Find.pm line 684. > # Tests were run but no plan was declared and done_testing() was not seen. > # Looks like your test exited with 255 just after 2. > t/kwalitee.t ............... Dubious, test returned 255 (wstat 65280, 0xff00) > > It works as expected again if I switch off taint checking again. > > (Noticed it because all other tests in the distribution have a shebang > line with "#!perl -T" so I added it to t/kwalitee.t, too.) > > The version of Test::Kwalitee is 1.22, the version of Perl is 5.20.0.

I'm confused - there is no t/kwalitee.t file in this distribution, and there are no shebangs in any tests. https://metacpan.org/source/ETHER/Test-Kwalitee-1.22/t

Thu Sep 11 12:21:32 2014 The RT System itself - Status changed from 'new' to 'open'

Thu Sep 11 12:32:18 2014 abe [...] deuxchevaux.org - Correspondence added

Subject:	Re: [rt.cpan.org #98795] Testing fails if test is run with taint checking switched on
Date:	Thu, 11 Sep 2014 18:32:04 +0200
To:	Karen Etheridge via RT <bug-Test-Kwalitee [...] rt.cpan.org>
From:	Axel Beckert <abe [...] deuxchevaux.org>

Hi Karen, On Thu, Sep 11, 2014 at 12:21:32PM -0400, Karen Etheridge via RT wrote: Show quoted text

> On Thu, Sep 11, 2014 at 11:29:22AM -0400, Axel Beckert via RT wrote:

> > (Noticed it because all other tests in the distribution have a shebang > > line with "#!perl -T" so I added it to t/kwalitee.t, too.) > > > > The version of Test::Kwalitee is 1.22, the version of Perl is 5.20.0.

> > I'm confused - there is no t/kwalitee.t file in this distribution, and > there are no shebangs in any tests.

Ah, sorry, I didn't want to make that sentence too nested and hence stripped off subordinate clause which seems to have been vital for understanding. Here's the full sentence again, in the hope it's clearer now, despite being nested: Noticed it because all other tests in the distribution where I wanted to add a Test::Kwalitee based check have a shebang line with "#!perl -T", so I added it to my newly created t/kwalitee.t, too. So basically my t/kwalitee.t looks as follows: #!perl -T use Test::More; BEGIN { plan skip_all => 'these tests are for release candidate testing' unless $ENV{RELEASE_TESTING}; } use Test::Kwalitee 'kwalitee_ok'; kwalitee_ok(); done_testing; (Everything except the shebang line is copied from the POD of Test::Kwalitee.) Kind regards, Axel -- /~\ Plain Text Ribbon Campaign | Axel Beckert \ / Say No to HTML in E-Mail and News | abe@deuxchevaux.org (Mail) X See http://www.nonhtmlmail.org/campaign.html | abe@noone.org (Mail+Jabber) / \ I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

Thu Sep 11 12:55:09 2014 ether [...] cpan.org - Correspondence added

Subject:	Re: [rt.cpan.org #98795] Testing fails if test is run with taint checking switched on
Date:	Thu, 11 Sep 2014 09:54:47 -0700
To:	Axel Beckert via RT <bug-Test-Kwalitee [...] rt.cpan.org>
From:	Karen Etheridge <ether [...] cpan.org>

On Thu, Sep 11, 2014 at 12:32:18PM -0400, Axel Beckert via RT wrote: Show quoted text

> Ah, sorry, I didn't want to make that sentence too nested and hence > stripped off subordinate clause which seems to have been vital for > understanding. Here's the full sentence again, in the hope it's > clearer now, despite being nested: > > Noticed it because all other tests in the distribution where I > wanted to add a Test::Kwalitee based check have a shebang line with > "#!perl -T", so I added it to my newly created t/kwalitee.t, too. > > So basically my t/kwalitee.t looks as follows: > > #!perl -T > > use Test::More; > BEGIN { > plan skip_all => 'these tests are for release candidate testing' > unless $ENV{RELEASE_TESTING}; > } > > use Test::Kwalitee 'kwalitee_ok'; > kwalitee_ok(); > done_testing; > > (Everything except the shebang line is copied from the POD of > Test::Kwalitee.)

Ah, I see now - ok, that makes sense!

Tue Sep 30 18:11:23 2014 ether [...] cpan.org - Taken

Sat Mar 14 14:26:23 2015 ether [...] cpan.org - Correspondence added

Show quoted text

> Insecure dependency in chdir while running with -T switch at /usr/share/perl/5.20/File/Find.pm line 684.

I can't reproduce this error -- when I run a kwalitee.t with the -T switch, everything works fine. Can you tell me the version of Module::CPANTS::Analyse you are running? (The entire dump of t/00-report-prereqs.t in Test-Kwalitee's test suite would be ideal.) Also, can you run the test exhibiting the failure with -d:Confess or -MCarp::Always to obtain a full stack trace? thanks!

Sat Mar 14 14:26:35 2015 ether [...] cpan.org - Status changed from 'open' to 'stalled'

Sun Mar 15 10:50:43 2015 abe [...] deuxchevaux.org - Correspondence added

Subject:	Re: [rt.cpan.org #98795] Testing fails if test is run with taint checking switched on
Date:	Sun, 15 Mar 2015 15:50:28 +0100
To:	Karen Etheridge via RT <bug-Test-Kwalitee [...] rt.cpan.org>
From:	Axel Beckert <abe [...] deuxchevaux.org>

Hi Karen, thanks for the feedback. On Sat, Mar 14, 2015 at 02:26:29PM -0400, Karen Etheridge via RT wrote: Show quoted text

> > Insecure dependency in chdir while running with -T switch at /usr/share/perl/5.20/File/Find.pm line 684.

> > I can't reproduce this error -- when I run a kwalitee.t with the -T switch, everything works fine. > > Can you tell me the version of Module::CPANTS::Analyse you are > running?

Back in September 2014 it likely was 0.92 as 0.95 was introduced in Debian Unstable only in October. (Based on the dates of my mails and the dates on https://packages.qa.debian.org/libmodule-cpants-analyse-perl) Show quoted text

> (The entire dump of t/00-report-prereqs.t in Test-Kwalitee's test > suite would be ideal.) Also, can you run the test exhibiting the > failure with -d:Confess or -MCarp::Always to obtain a full stack > trace?

I'll check with Module::CPANTS::Analyse 0.95 (0.96 is not yet available in Debian Unstable due to the freeze for the next Debian Stable release) and will check if the issue is still there. (If so, I'll also check 0.96. If not, I'll close this issue.) Kind regards, Axel -- /~\ Plain Text Ribbon Campaign | Axel Beckert \ / Say No to HTML in E-Mail and News | abe@deuxchevaux.org (Mail) X See http://www.nonhtmlmail.org/campaign.html | abe@noone.org (Mail+Jabber) / \ I love long mails: http://email.is-not-s.ms/ | http://abe.noone.org/ (Web)

Sun Mar 15 10:50:43 2015 The RT System itself - Status changed from 'stalled' to 'open'

Fri Apr 10 00:29:18 2015 ether [...] cpan.org - Status changed from 'open' to 'stalled'