Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix RT #81381 - Make LWP::UserAgent robust to 5.17.6/5.18 hash randomization #355

Merged
merged 1 commit into from Dec 16, 2020

Commits on Dec 14, 2020

  1. Fix RT #81381 - Make LWP::UserAgent robust to 5.17.6/5.18 hash random…

    …ization
    
    Audited and fixed any potential hash order dependency bugs in
    LWP::UserAgent. I replaced all the uses of each() with keys() to avoid
    hash iterator state bugs, and made sure that keys are sorted where
    their order might matter, which was as far as I could tell only in
    how proxy configuration was read from the envrionment.
    
    There was ambiguity as to which of $ENV{http_proxy} and
    $ENV{HTTP_PROXY} would be chosen by LWP::UserAgent->env_proxy(). We now
    choose HTTP_PROXY if both are set, and if they differ we warn about
    the conflicting configuration.
    
    This patch includes tests to check that we warn on conflicting config
    and that we correctly handle setting via either.
    
    This includes a version bump to 6.05.
    
    See also:
    
    libwww-perl RT Ticket
        https://rt.cpan.org/Ticket/Display.html?id=81381
    
    bleadperl 5.17.6 patch (queued for 5.18):
        http://perl5.git.perl.org/perl.git/commit/7dc8663964c66a698d31bbdc8e8abed69bddeec3
    
    Eliminating the "rehash" mechanism for 5.18
        http://www.nntp.perl.org/group/perl.perl5.porters/2012/10/msg194813.html
    
    Switch perl's hash function to MurmurHash-32 (v3) and hash randomization by default.
        http://www.nntp.perl.org/group/perl.perl5.porters/2012/11/msg195492.html
    demerphq authored and oalders committed Dec 14, 2020
    Copy the full SHA
    c07ba68 View commit details
    Browse the repository at this point in the history