develooper Front page | perl.perl5.porters | Postings from July 2012

Re: the "require" branch, maintperl, and security

Thread Previous | Thread Next
From:
Father Chrysostomos
Date:
July 25, 2012 14:24
Subject:
Re: the "require" branch, maintperl, and security
Message ID:
20120725212413.14159.qmail@lists-nntp.develooper.com
rjbs wrote:
> The smoke-me/require branch contains a fix for this bug, and will land on
> blead shortly assuming further testing finds no problems.

That fix does not look correct to me.

Why should require ::foo be treated as require foo, but not ::::foo or
main::foo?

Also, require ::::foo produces this error message:

$ ./miniperl -Ilib -e 'require ::::foo'
Bareword in require maps to disallowed filename "/foo.pm" at -e line 1.

But perldiag says this:

(F) The bareword form of require has been invoked with a filename which could
not have been generated by a valid bareword permitted by the parser. You
shouldn't be able to get this error from Perl code, but XS code may throw it
if it passes an invalid module name to C<Perl_load_module>.

I suggest not applying the s/::foo/foo/ patch and changing perldiag.

Does the file name validation have to be a run-time check?  Cannot it
go in ck_require?  Yes, I am suggesting making require ::foo a com-
pile-time error, but that does not break any more code than making it
an error at run time, since it was not an error before.  Making it a
compile-time error makes pp_require faster, and keeps the bareword-
handling code in just two places, instead of three.


Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About