Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix RT #81381 - Make LWP::UserAgent robust to 5.17.6/5.18 hash randomization #355

Merged
merged 1 commit into from Dec 16, 2020

Conversation

oalders
Copy link
Member

@oalders oalders commented Dec 14, 2020

This is a rebased and slightly edited version of gisle#3 by @demerphq

Audited and fixed any potential hash order dependency bugs in
LWP::UserAgent. I replaced all the uses of each() with keys() to avoid
hash iterator state bugs, and made sure that keys are sorted where
their order might matter, which was as far as I could tell only in
how proxy configuration was read from the envrionment.

There was ambiguity as to which of $ENV{http_proxy} and
$ENV{HTTP_PROXY} would be chosen by LWP::UserAgent->env_proxy(). We now
choose HTTP_PROXY if both are set, and if they differ we warn about
the conflicting configuration.

This patch includes tests to check that we warn on conflicting config
and that we correctly handle setting via either.

This includes a version bump to 6.05.

See also:

libwww-perl RT Ticket
https://rt.cpan.org/Ticket/Display.html?id=81381

bleadperl 5.17.6 patch (queued for 5.18):
http://perl5.git.perl.org/perl.git/commit/7dc8663964c66a698d31bbdc8e8abed69bddeec3

Eliminating the "rehash" mechanism for 5.18
http://www.nntp.perl.org/group/perl.perl5.porters/2012/10/msg194813.html

Switch perl's hash function to MurmurHash-32 (v3) and hash randomization by default.
http://www.nntp.perl.org/group/perl.perl5.porters/2012/11/msg195492.html

…ization

Audited and fixed any potential hash order dependency bugs in
LWP::UserAgent. I replaced all the uses of each() with keys() to avoid
hash iterator state bugs, and made sure that keys are sorted where
their order might matter, which was as far as I could tell only in
how proxy configuration was read from the envrionment.

There was ambiguity as to which of $ENV{http_proxy} and
$ENV{HTTP_PROXY} would be chosen by LWP::UserAgent->env_proxy(). We now
choose HTTP_PROXY if both are set, and if they differ we warn about
the conflicting configuration.

This patch includes tests to check that we warn on conflicting config
and that we correctly handle setting via either.

This includes a version bump to 6.05.

See also:

libwww-perl RT Ticket
    https://rt.cpan.org/Ticket/Display.html?id=81381

bleadperl 5.17.6 patch (queued for 5.18):
    http://perl5.git.perl.org/perl.git/commit/7dc8663964c66a698d31bbdc8e8abed69bddeec3

Eliminating the "rehash" mechanism for 5.18
    http://www.nntp.perl.org/group/perl.perl5.porters/2012/10/msg194813.html

Switch perl's hash function to MurmurHash-32 (v3) and hash randomization by default.
    http://www.nntp.perl.org/group/perl.perl5.porters/2012/11/msg195492.html
@coveralls
Copy link

Coverage Status

Coverage increased (+0.2%) to 60.587% when pulling c07ba68 on oalders/hash-randomization into c9ee037 on master.

Copy link
Contributor

@simbabque simbabque left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@oalders
Copy link
Member Author

oalders commented Dec 16, 2020

Thanks @simbabque!

@oalders oalders merged commit 7c16b13 into master Dec 16, 2020
@oalders oalders deleted the oalders/hash-randomization branch December 16, 2020 02:12
@oalders oalders restored the oalders/hash-randomization branch December 16, 2020 02:12
@oalders oalders deleted the oalders/hash-randomization branch December 16, 2020 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants