Skip to content
Permalink
Browse files Browse the repository at this point in the history
* 0.72 with an improved path checker from @fweimer
  • Loading branch information
audreyt committed Jun 5, 2013
1 parent 1af7b1a commit cbd06b3
Show file tree
Hide file tree
Showing 4 changed files with 12 additions and 3 deletions.
7 changes: 7 additions & 0 deletions Changes
@@ -1,3 +1,10 @@
[Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013]

* Only allow loading Digest::* from absolute paths in @INC,
by ensuring they begin with \ or / characters.

Contributed by: Florian Weimer

[Changes for 0.71 - Tue Jun 4 18:24:10 CST 2013]

* Constrain the user-specified digest name to /^\w+\d+$/.
Expand Down
2 changes: 1 addition & 1 deletion META.yml
Expand Up @@ -25,4 +25,4 @@ requires:
perl: 5.005
resources:
repository: http://github.com/audreyt/module-signature
version: 0.71
version: 0.72
2 changes: 2 additions & 0 deletions README
Expand Up @@ -245,6 +245,8 @@ SEE ALSO

Module::Install, ExtUtils::MakeMaker, Module::Build

Dist::Zilla::Plugin::Signature

AUTHORS
唐鳳 <cpan@audreyt.org>

Expand Down
4 changes: 2 additions & 2 deletions lib/Module/Signature.pm
@@ -1,5 +1,5 @@
package Module::Signature;
$Module::Signature::VERSION = '0.71';
$Module::Signature::VERSION = '0.72';

use 5.005;
use strict;
Expand Down Expand Up @@ -534,7 +534,7 @@ sub _digest_object {
my($algorithm) = @_;

# Avoid loading Digest::* from relative paths in @INC.
local @INC = grep { /^[^.]/ } @INC;
local @INC = grep { m{^[\\/]} } @INC;

# Constrain algorithm name to be of form ABC123.
my ($base, $variant) = ($algorithm =~ /^([_a-zA-Z]+)([0-9]+)$/g)
Expand Down

4 comments on commit cbd06b3

@abraxxa
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Won't that simple check fail on platforms like Win32?

@audreyt
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would — nice catch! Although in https://github.com/audreyt/module-signature/blob/master/Makefile.PL#L19 we already rejected Win32.

@abraxxa
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't the 'and 0' skip the if block?

@audreyt
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're absolutely correct. 😊 Mea Culpa.

This has been corrected in 8ff56de#L2R538 as of 2013-06-05; that's the version running on CPAN.

Please sign in to comment.