Fix misparsing of maketext strings.
authorBrian Carlson <brian.carlson@cpanel.net>
Wed, 28 Nov 2012 13:54:33 +0000 (08:54 -0500)
committerRicardo Signes <rjbs@cpan.org>
Tue, 4 Dec 2012 19:06:33 +0000 (14:06 -0500)
Case 61251: This commit fixes a misparse of maketext strings that could
lead to arbitrary code execution.  Basically, maketext was compiling
bracket notation into functions, but neglected to escape backslashes
inside the content or die on fully-qualified method names when
generating the code.  This change escapes all such backslashes and dies
when a method name with a colon or apostrophe is specified.

AUTHORS
dist/Locale-Maketext/lib/Locale/Maketext.pm

index 70734b0..009dea0 100644 (file)
--- a/AUTHORS
+++ b/AUTHORS
@@ -154,6 +154,7 @@ Breno G. de Oliveira                <garu@cpan.org>
 Brent Dax                      <brentdax@cpan.org>
 Brooks D Boyd
 Brian Callaghan                        <callagh@itginc.com>
+Brian Carlson                  <brian.carlson@cpanel.net>
 Brian Clarke                   <clarke@appliedmeta.com>
 brian d foy                    <brian.d.foy@gmail.com>
 Brian Fraser                   <fraserbn@gmail.com>
index 4822027..63e5fba 100644 (file)
@@ -625,21 +625,9 @@ sub _compile {
                         # 0-length method name means to just interpolate:
                         push @code, ' (';
                     }
-                    elsif($m =~ /^\w+(?:\:\:\w+)*$/s
-                            and $m !~ m/(?:^|\:)\d/s
-                        # exclude starting a (sub)package or symbol with a digit
+                    elsif($m =~ /^\w+$/s
+                        # exclude anything fancy, especially fully-qualified module names
                     ) {
-                        # Yes, it even supports the demented (and undocumented?)
-                        #  $obj->Foo::bar(...) syntax.
-                        $target->_die_pointing(
-                            $string_to_compile, q{Can't use "SUPER::" in a bracket-group method},
-                            2 + length($c[-1])
-                        )
-                        if $m =~ m/^SUPER::/s;
-                        # Because for SUPER:: to work, we'd have to compile this into
-                        #  the right package, and that seems just not worth the bother,
-                        #  unless someone convinces me otherwise.
-
                         push @code, ' $_[0]->' . $m . '(';
                     }
                     else {
@@ -693,7 +681,9 @@ sub _compile {
             elsif(substr($1,0,1) ne '~') {
                 # it's stuff not containing "~" or "[" or "]"
                 # i.e., a literal blob
-                $c[-1] .= $1;
+                my $text = $1;
+                $text =~ s/\\/\\\\/g;
+                $c[-1] .= $text;
 
             }
             elsif($1 eq '~~') { # "~~"
@@ -731,7 +721,9 @@ sub _compile {
             else {
                 # It's a "~X" where X is not a special character.
                 # Consider it a literal ~ and X.
-                $c[-1] .= $1;
+                my $text = $1;
+                $text =~ s/\\/\\\\/g;
+                $c[-1] .= $text;
             }
         }
     }