XSLoader may load relative paths #15418
Comments
From @cpansproutSee <https://rt.cpan.org/Ticket/Display.html?id=115808>. I have already pushed a fix for this as 08e3451. If the current CPAN maintainer of XSLoader is unavailable, then what is our next step? Can someone else make a release? Should I go ahead and push my fix to maint-5.2x? |
From @tonycozOn Sun Jul 03 11:24:54 2016, sprout wrote:
+ # Does this look like a relative path? Absolute paths might not start with a / or \ on Win32, VMS and (I think) AmigaOS. Unfortunately loading File::Spec calls back into XSLoader, so you can't use File::Spec->file_name_is_absolute Tony |
The RT System itself - Status changed from 'new' to 'open' |
From @craigberryOn Sun, Jul 3, 2016 at 7:11 PM, Tony Cook via RT
The package filenames returned by caller() as well as @INC entries are On Windows, it looks like both @INC and the package filenames have Do we really have a problem with relative paths as such, or do we have |
From @craigberryOn Sun, Jul 3, 2016 at 10:28 PM, Craig A. Berry <craig.a.berry@gmail.com> wrote:
I think I said that backwards -- it's absolute paths that will be |
From @jhiOn Monday-201607-04 3:11, Tony Cook via RT wrote:
IIUC yes for AmigaOS, it uses the same kind of "multi-root" (volume)
Which of course feels kind of stupid. Cwd, I am guessing without (Cwd being an XS has always been kind of strange, it leads into |
From @demerphqOn 4 Jul 2016 02:19, "Jarkko Hietaniemi" <jhi@iki.fi> wrote:
++ to that... |
From @cpansproutOn Jul 4, 2016, at 9:57 AM, "yves orton via RT" <perl5-security-report@perl.org> wrote:
I just looked through all the various implementations of file_name_is_absolute and came up with commit v5.25.2-95-ga651dcd, now pushed to blead. As I pointed out in the commit message, it’s not the end of the world if we mistakenly view some paths as relative, but it will be slightly slower. |
From @cpansproutOn Jul 3, 2016, at 8:29 PM, "Craig Berry via RT" <perl5-security-report@perl.org> wrote:
‘(eval’ specifically, but that just reveals the problem. There are numerous reasons why one might use #line directives to change the file name. XSLoader’s documentation does not warn users about it, and, quite frankly, I don’t think users should have to worry about it. |
From @tonycozOn Sun, 03 Jul 2016 11:24:54 -0700, sprout wrote:
This is fixed in blead and on CPAN - does it need to be fixed anywhere else Tony |
From @iabynOn Sun, Jan 22, 2017 at 08:19:29PM -0800, Tony Cook via RT wrote:
The two XSloader fixes (don't load relative paths, and recognize drive I also think it can be moved to the public queue, as the XS loader issue -- |
From @iabynOn Tue, Feb 21, 2017 at 10:31:01AM +0000, Dave Mitchell wrote:
which I am now doing. -- |
@iabyn - Status changed from 'open' to 'resolved' |
Migrated from rt.perl.org#128528 (status was 'resolved')
Searchable as RT128528$
The text was updated successfully, but these errors were encountered: