develooper Front page | perl.perl5.porters | Postings from August 2012

Re: the "require" branch, maintperl, and security

Thread Previous | Thread Next
From:
Father Chrysostomos
Date:
August 1, 2012 22:27
Subject:
Re: the "require" branch, maintperl, and security
Message ID:
61135D86-209D-4846-870E-7B520DF65FCE@cpan.org

On Aug 1, 2012, at 1:11 PM, Ricardo Signes wrote:

> * Nicholas Clark <nick@ccl4.org> [2012-07-26T05:50:06]
>> On Wed, Jul 25, 2012 at 09:24:13PM -0000, Father Chrysostomos wrote:
>>> rjbs wrote:
>>>> The smoke-me/require branch contains a fix for this bug, and will land on
>>>> blead shortly assuming further testing finds no problems.
>>> 
>>> That fix does not look correct to me.
>>> 
>>> Why should require ::foo be treated as require foo, but not ::::foo or
>>> main::foo?
>> 
>> As to ::foo vs ::::foo, because they are not the same:
>> [...]
> 
> The answer to the disagreement here is not obvious to me without more time, and
> we've classified this problem as only a bug fix, rather than a critical
> security issue, so I am tempted to get 5.16.1 shipped for the CLEAR bug fixes
> rather than wait much longer for this.

The change that makes ‘require ::foo’ mean ‘require foo’ is an incompatible change.  Such a change should be supported by sound reasoning.  The reasoning here is that ::foo and foo refer to the same package, therefore they should load the same module.  But that conflates packages and modules, which are not the same.  main::foo and main::main::main::foo also refer to the same package as ::foo, so should require main::foo change?  I hope not.  Therefore I don’t consider the reasoning sound.  Hence, since we are changing its behaviour, require ::foo should be made an error, for consistency with require ::::foo.  (BTW, foo::bar and foo::::bar refer to different packages, but the same module.)


Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About