Skip Menu |
 

This queue is for tickets about the Nmap-Scanner CPAN distribution.

Report information
The Basics
Id: 118745
Status: new
Priority: 0/
Queue: Nmap-Scanner

People
Owner: Nobody in particular
Requestors: eponymousalias [...] yahoo.com
Cc:
AdminCc:

Bug Information
Severity: Important
Broken in: 1.0
Fixed in: (no value)



Subject: XMLification fixes for Nmap::Scanner 1.0
Download (untitled) / with headers
text/plain 808b
The Nmap::Scanner 1.0 package straight from CPAN has a variety of issues. (*) It relies too much on undef, which throws "Use of uninitialized value" warnings from various places. (*) It does not properly XML-encode certain characters, notably ampersand, that it receives from nmap. (*) When it does try to encode entities, it uses HTML encoding instead of XML encoding or numeric entity encoding, which means that inappropriate (non-XML) entities may be referenced. (*) It mixes up <nmap-err> and </nmap-msg> tags. I have run a lot of tests and addressed all the instances of such problems found in that testing. The resulting patch is attached here as the Nmap::Scanner-1.0.patch file. As presented, for simplicity, the patch uses the Perl "//" operator, first available in Perl 5.10.
Subject: Nmap::Scanner-1.0.patch
--- Nmap/Scanner/Address.pm.orig 2005-08-29 18:51:40.000000000 -0700 +++ Nmap/Scanner/Address.pm 2016-10-08 17:01:04.182778210 -0700 @@ -7,8 +7,10 @@ vendor $), '&as_xml' => q!return qq(<address addr="$addr" ) . qq(addrtype="$addrtype" ) . - qq(vendor="$vendor"/>);! -}; + qq(vendor=").encode_entities_numeric($vendor).qq("/>);! +}, +'-use' => ["HTML::Entities 'encode_entities_numeric'"] +; =pod --- Nmap/Scanner/Backend/XML.pm.orig 2006-10-29 11:05:38.000000000 -0800 +++ Nmap/Scanner/Backend/XML.pm 2016-10-17 18:25:00.175738945 -0700 @@ -6,6 +6,7 @@ @ISA = qw(Nmap::Scanner::Backend::Processor); use XML::SAX::ParserFactory; +use HTML::Entities qw(encode_entities_numeric); use Nmap::Scanner; use Nmap::Scanner::Backend::Results; @@ -29,7 +30,7 @@ # Suppress warnings about reading unopened handle $^W = 0; - my $err = join('', (<$error>)); + my $err = encode_entities_numeric(join('', (<$error>))); $^W = 1; if ($err ne '') { @@ -41,7 +42,7 @@ <nmap-error> <pid="$pid"/> <cmdline="$cmdline"/> - <nmap-err>$err</nmap-msg> + <nmap-err>$err</nmap-err> </nmap-error> EOF exit 1; @@ -55,7 +56,7 @@ if (defined($@) && ($@ ne '')) { - my $msg = join('', <$read>); + my $msg = encode_entities_numeric(join('', <$read>)); Nmap::Scanner::debug("bytes in input stream: " . tell($read)); Nmap::Scanner::debug("bytes in error stream: " . tell($error)); @@ -66,7 +67,7 @@ <cmdline="$cmdline"/> <perl-msg>$@</perl-msg> <nmap-msg>$msg</nmap-msg> - <nmap-err>$err</nmap-msg> + <nmap-err>$err</nmap-err> </nmap-error> EOF close($read); @@ -282,8 +283,7 @@ my $addr = Nmap::Scanner::Address->new(); $addr->addr($ref->{'{}addr'}->{Value}); $addr->addrtype($ref->{'{}addrtype'}->{Value}); - $addr->vendor($ref->{'{}vendor'}->{Value}) - if $ref->{'{}vendor'}->{Value}; + $addr->vendor($ref->{'{}vendor'}->{Value} // ''); $self->{NMAP_HOST}->add_address($addr); } @@ -356,10 +356,10 @@ my ($self, $ref) = @_; my $os = $self->{NMAP_OSGUESS}; my $class = Nmap::Scanner::OS::Class->new(); - $class->type($ref->{'{}type'}->{Value}); - $class->vendor($ref->{'{}vendor'}->{Value}); + $class->type($ref->{'{}type'}->{Value} // ''); + $class->vendor($ref->{'{}vendor'}->{Value} // ''); $class->osfamily($ref->{'{}osfamily'}->{Value}); - $class->osgen($ref->{'{}osgen'}->{Value}); + $class->osgen($ref->{'{}osgen'}->{Value} // ''); $class->accuracy($ref->{'{}accuracy'}->{Value}); $os->add_os_class($class); } @@ -405,7 +405,7 @@ my $os = $self->{NMAP_OSGUESS}; my $t = Nmap::Scanner::OS::TCPSequence->new(); $t->index($ref->{'{}index'}->{Value}); - $t->class($ref->{'{}class'}->{Value}); + $t->class($ref->{'{}class'}->{Value} // ''); $t->difficulty($ref->{'{}difficulty'}->{Value}); $t->values($ref->{'{}values'}->{Value}); $os->tcpsequence($t); @@ -415,7 +415,7 @@ my ($self, $ref) = @_; my $os = $self->{NMAP_OSGUESS}; my $t = Nmap::Scanner::OS::TCPTSSequence->new(); - $t->class($ref->{'{}class'}->{Value}); + $t->class($ref->{'{}class'}->{Value} // ''); $t->values($ref->{'{}values'}->{Value}); $os->tcptssequence($t); } @@ -424,7 +424,7 @@ my ($self, $ref) = @_; my $os = $self->{NMAP_OSGUESS}; my $t = Nmap::Scanner::OS::IPIdSequence->new(); - $t->class($ref->{'{}class'}->{Value}); + $t->class($ref->{'{}class'}->{Value} // ''); $t->values($ref->{'{}values'}->{Value}); $os->ipidsequence($t); } --- Nmap/Scanner/Host.pm.orig 2006-10-29 09:55:00.000000000 -0800 +++ Nmap/Scanner/Host.pm 2016-10-08 06:44:13.260046410 -0700 @@ -65,7 +65,7 @@ } $xml .= qq(<smurf responses="$self->{smurf}"/>\n) - if $self->{smurf} > 0; + if $self->{smurf}; my $hxml = ''; --- Nmap/Scanner/HostList.pm.orig 2005-08-29 18:51:40.000000000 -0700 +++ Nmap/Scanner/HostList.pm 2016-10-06 08:23:00.624539338 -0700 @@ -21,7 +21,7 @@ my $self = shift; - my $xml; + my $xml = ''; while (my $host = $self->get_next()) { last unless defined $host; --- Nmap/Scanner/OS.pm.orig 2006-10-28 22:14:50.000000000 -0700 +++ Nmap/Scanner/OS.pm 2016-10-17 18:04:05.676806669 -0700 @@ -18,7 +18,7 @@ '&as_xml' => q! # No fingerprinting happened if no ports found to fingerprint with. - return unless scalar($self->ports_used()) > 0; + return '' unless scalar($self->ports_used() // @{[]}) > 0; my $xml = "<os>\n"; --- Nmap/Scanner/OS/Class.pm.orig 2005-08-29 18:51:42.000000000 -0700 +++ Nmap/Scanner/OS/Class.pm 2016-10-08 17:03:10.917694648 -0700 @@ -11,12 +11,14 @@ accuracy $), '&as_xml' => q! - return qq(<osclass type="$self->{type}" vendor="$self->{vendor}" ) . + return qq(<osclass type="$self->{type}" vendor=").encode_entities_numeric($self->{vendor}).qq(" ) . qq(osfamily="$self->{osfamily}" osgen="$self->{osgen}" ) . qq(accuracy="$self->{accuracy}"/>); ! -}; +}, +'-use' => ["HTML::Entities 'encode_entities_numeric'"] +; 1; --- Nmap/Scanner/OS/Match.pm.orig 2005-08-29 18:51:42.000000000 -0700 +++ Nmap/Scanner/OS/Match.pm 2016-10-08 17:06:09.580040299 -0700 @@ -6,11 +6,12 @@ class 'Nmap::Scanner::OS::Match' => { qw(name $ accuracy $), - '&as_xml' => q!my $osname = HTML::Entities::encode_entities($self->{name}); + '&as_xml' => q!my $osname = encode_entities_numeric($self->{name}); qq(<osmatch name="$osname" ) . qq(accuracy="$self->{accuracy}"/>);! }, -'-use' => 'HTML::Entities'; +'-use' => ["HTML::Entities 'encode_entities_numeric'"] +; 1; --- Nmap/Scanner/PortList.pm.orig 2005-08-29 18:51:40.000000000 -0700 +++ Nmap/Scanner/PortList.pm 2016-10-08 06:45:07.186597886 -0700 @@ -31,7 +31,7 @@ sub as_xml { my $self = shift; - my $xml; + my $xml = ''; while (my $p = $self->get_next()) { last unless defined $p; --- Nmap/Scanner/Service.pm.orig 2005-08-29 18:51:40.000000000 -0700 +++ Nmap/Scanner/Service.pm 2016-10-08 17:04:38.316776484 -0700 @@ -29,7 +29,7 @@ for my $ee (qw(product extrainfo)) { next unless $self->{$ee}; - my $encoded = encode_entities($self->{$ee}); + my $encoded = encode_entities_numeric($self->{$ee}); $body .= qq($ee="$encoded" ); } @@ -37,7 +37,7 @@ ! }, -'-use' => 'HTML::Entities' +'-use' => ["HTML::Entities 'encode_entities_numeric'"] ; =pod


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.