Skip Menu |
 

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the CGI CPAN distribution.

Report information
The Basics
Id: 31187
Status: resolved
Priority: 0/
Queue: CGI

People
Owner: Nobody in particular
Requestors: METAL [...] cpan.org
Cc:
AdminCc:

Bug Information
Severity: Important
Broken in: (no value)
Fixed in: (no value)



Subject: [PATCH] t/upload.t fails on Win32 systems if $ENV{TMPDIR} contains short names
Download (untitled) / with headers
text/plain 516b
On a Windows XP SP2 machine running a local build of 5.8.8 with patches from ActivePerl, CGI.pm 3.31 fails in "nmake test". "t/upload.t" exits without reporting any tests. The TEMP and TMPDIR environment variables on this machine are set to paths using "short" (8.3) filenames to coddle stupid Unix software that can't handle spaces in paths ;). Short names include the ~ (tilde) character, which is rejected by the regexes at lines 3706, 4024, 4045 of CGI.pm; thus, tempfile creation always fails. Patch attached.
Subject: CGI.pm.diff
Download CGI.pm.diff
text/x-diff 1.2k
--- CGI.pm 2007-12-04 04:29:53.137940400 -0500 +++ blib\lib\CGI.pm 2007-12-04 04:20:48.000000000 -0500 @@ -3703,7 +3703,7 @@ (my $safename = $name) =~ s/([':%])/ sprintf '%%%02X', ord $1 /eg; my $fv = ++$FH . $safename; my $ref = \*{"Fh::$fv"}; - $file =~ m!^([a-zA-Z0-9_\+ \'\":/.\$\\-]+)$! || return; + $file =~ m!^([a-zA-Z0-9_\+ ~\'\":/.\$\\-]+)$! || return; my $safe = $1; sysopen($ref,$safe,Fcntl::O_RDWR()|Fcntl::O_CREAT()|Fcntl::O_EXCL(),0600) || return; unlink($safe) if $delete; @@ -4021,7 +4021,7 @@ sub DESTROY { my($self) = @_; - $$self =~ m!^([a-zA-Z0-9_ \'\":/.\$\\-]+)$! || return; + $$self =~ m!^([a-zA-Z0-9_ ~\'\":/.\$\\-]+)$! || return; my $safe = $1; # untaint operation unlink $safe; # get rid of the file } @@ -4042,7 +4042,7 @@ last if ! -f ($filename = sprintf("${TMPDIRECTORY}${SL}CGItemp%d",$sequence++)); } # check that it is a more-or-less valid filename - return unless $filename =~ m!^([a-zA-Z0-9_\+ \'\":/.\$\\-]+)$!; + return unless $filename =~ m!^([a-zA-Z0-9_\+ ~\'\":/.\$\\-]+)$!; # this used to untaint, now it doesn't # $filename = $1; return bless \$filename;
Sorry for the double-post... *sheepish grin* It's late and my fingers are thumbful.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.