Commit | Line | Data |
---|---|---|
f4a48a9e SH |
1 | =encoding utf8 |
2 | ||
3 | =head1 NAME | |
4 | ||
5 | perl5223delta - what is new for perl v5.22.3 | |
6 | ||
7 | =head1 DESCRIPTION | |
8 | ||
9 | This document describes differences between the 5.22.2 release and the 5.22.3 | |
10 | release. | |
11 | ||
12 | If you are upgrading from an earlier release such as 5.22.1, first read | |
13 | L<perl5222delta>, which describes differences between 5.22.1 and 5.22.2. | |
14 | ||
15 | =head1 Security | |
16 | ||
17 | =head2 B<-Di> switch is now required for PerlIO debugging output | |
18 | ||
19 | Previously PerlIO debugging output would be sent to the file specified by the | |
20 | C<PERLIO_DEBUG> environment variable if perl wasn't running setuid and the | |
21 | B<-T> or B<-t> switches hadn't been parsed yet. | |
22 | ||
23 | If perl performed output at a point where it hadn't yet parsed its switches | |
24 | this could result in perl creating or overwriting the file named by | |
25 | C<PERLIO_DEBUG> even when the B<-T> switch had been supplied. | |
26 | ||
27 | Perl now requires the B<-Di> switch to produce PerlIO debugging output. By | |
28 | default this is written to C<stderr>, but can optionally be redirected to a | |
29 | file by setting the C<PERLIO_DEBUG> environment variable. | |
30 | ||
31 | If perl is running setuid or the B<-T> switch was supplied C<PERLIO_DEBUG> is | |
32 | ignored and the debugging output is sent to C<stderr> as for any other B<-D> | |
33 | switch. | |
34 | ||
35 | =head2 Core modules and tools no longer search F<"."> for optional modules | |
36 | ||
37 | The tools and many modules supplied in core no longer search the default | |
38 | current directory entry in L<C<@INC>|perlvar/@INC> for optional modules. For | |
39 | example, L<Storable> will remove the final F<"."> from C<@INC> before trying to | |
40 | load L<Log::Agent>. | |
41 | ||
42 | This prevents an attacker injecting an optional module into a process run by | |
43 | another user where the current directory is writable by the attacker, e.g. the | |
44 | F</tmp> directory. | |
45 | ||
46 | In most cases this removal should not cause problems, but difficulties were | |
47 | encountered with L<base>, which treats every module name supplied as optional. | |
48 | These difficulties have not yet been resolved, so for this release there are no | |
49 | changes to L<base>. We hope to have a fix for L<base> in Perl 5.22.4. | |
50 | ||
51 | To protect your own code from this attack, either remove the default F<"."> | |
52 | entry from C<@INC> at the start of your script, so: | |
53 | ||
54 | #!/usr/bin/perl | |
55 | use strict; | |
56 | ... | |
57 | ||
58 | becomes: | |
59 | ||
60 | #!/usr/bin/perl | |
61 | BEGIN { pop @INC if $INC[-1] eq '.' } | |
62 | use strict; | |
63 | ... | |
64 | ||
65 | or for modules, remove F<"."> from a localized C<@INC>, so: | |
66 | ||
67 | my $can_foo = eval { require Foo; } | |
68 | ||
69 | becomes: | |
70 | ||
71 | my $can_foo = eval { | |
72 | local @INC = @INC; | |
73 | pop @INC if $INC[-1] eq '.'; | |
74 | require Foo; | |
75 | }; | |
76 | ||
77 | =head1 Incompatible Changes | |
78 | ||
79 | Other than the security changes above there are no changes intentionally | |
80 | incompatible with Perl 5.22.2. If any exist, they are bugs, and we request | |
81 | that you submit a report. See L</Reporting Bugs> below. | |
82 | ||
83 | =head1 Modules and Pragmata | |
84 | ||
85 | =head2 Updated Modules and Pragmata | |
86 | ||
87 | =over 4 | |
88 | ||
89 | =item * | |
90 | ||
91 | L<Archive::Tar> has been upgraded from version 2.04 to 2.04_01. | |
92 | ||
93 | =item * | |
94 | ||
95 | L<bignum> has been upgraded from version 0.39 to 0.39_01. | |
96 | ||
97 | =item * | |
98 | ||
99 | L<CPAN> has been upgraded from version 2.11 to 2.11_01. | |
100 | ||
101 | =item * | |
102 | ||
103 | L<Digest> has been upgraded from version 1.17 to 1.17_01. | |
104 | ||
105 | =item * | |
106 | ||
107 | L<Digest::SHA> has been upgraded from version 5.95 to 5.95_01. | |
108 | ||
109 | =item * | |
110 | ||
111 | L<Encode> has been upgraded from version 2.72 to 2.72_01. | |
112 | ||
113 | =item * | |
114 | ||
115 | L<ExtUtils::Command> has been upgraded from version 1.20 to 1.20_01. | |
116 | ||
117 | =item * | |
118 | ||
119 | L<ExtUtils::MakeMaker> has been upgraded from version 7.04_01 to 7.04_02. | |
120 | ||
121 | =item * | |
122 | ||
123 | L<File::Fetch> has been upgraded from version 0.48 to 0.48_01. | |
124 | ||
125 | =item * | |
126 | ||
127 | L<File::Spec> has been upgraded from version 3.56_01 to 3.56_02. | |
128 | ||
129 | =item * | |
130 | ||
131 | L<HTTP::Tiny> has been upgraded from version 0.054 to 0.054_01. | |
132 | ||
133 | =item * | |
134 | ||
135 | L<IO> has been upgraded from version 1.35 to 1.35_01. | |
136 | ||
137 | =item * | |
138 | ||
139 | The IO-Compress modules have been upgraded from version 2.068 to 2.068_001. | |
140 | ||
141 | =item * | |
142 | ||
143 | L<IPC::Cmd> has been upgraded from version 0.92 to 0.92_01. | |
144 | ||
145 | =item * | |
146 | ||
147 | L<JSON::PP> has been upgraded from version 2.27300 to 2.27300_01. | |
148 | ||
149 | =item * | |
150 | ||
151 | L<Locale::Maketext> has been upgraded from version 1.26 to 1.26_01. | |
152 | ||
153 | =item * | |
154 | ||
155 | L<Locale::Maketext::Simple> has been upgraded from version 0.21 to 0.21_01. | |
156 | ||
157 | =item * | |
158 | ||
159 | L<Memoize> has been upgraded from version 1.03 to 1.03_01. | |
160 | ||
161 | =item * | |
162 | ||
163 | L<Module::CoreList> has been upgraded from version 5.20160429 to 5.20170114_22. | |
164 | ||
165 | =item * | |
166 | ||
167 | L<Net::Ping> has been upgraded from version 2.43 to 2.43_01. | |
168 | ||
169 | =item * | |
170 | ||
171 | L<Parse::CPAN::Meta> has been upgraded from version 1.4414 to 1.4414_001. | |
172 | ||
173 | =item * | |
174 | ||
175 | L<Pod::Html> has been upgraded from version 1.22 to 1.2201. | |
176 | ||
177 | =item * | |
178 | ||
179 | L<Pod::Perldoc> has been upgraded from version 3.25 to 3.25_01. | |
180 | ||
181 | =item * | |
182 | ||
183 | L<Storable> has been upgraded from version 2.53_01 to 2.53_02. | |
184 | ||
185 | =item * | |
186 | ||
187 | L<Sys::Syslog> has been upgraded from version 0.33 to 0.33_01. | |
188 | ||
189 | =item * | |
190 | ||
191 | L<Test> has been upgraded from version 1.26 to 1.26_01. | |
192 | ||
193 | =item * | |
194 | ||
195 | L<Test::Harness> has been upgraded from version 3.35 to 3.35_01. | |
196 | ||
197 | =item * | |
198 | ||
199 | L<XSLoader> has been upgraded from version 0.20 to 0.20_01, fixing a security | |
200 | hole in which binary files could be loaded from a path outside of C<@INC>. | |
201 | L<[perl #128528]|https://rt.perl.org/Public/Bug/Display.html?id=128528> | |
202 | ||
203 | =back | |
204 | ||
205 | =head1 Documentation | |
206 | ||
207 | =head2 Changes to Existing Documentation | |
208 | ||
209 | =head3 L<perlapio> | |
210 | ||
211 | =over 4 | |
212 | ||
213 | =item * | |
214 | ||
215 | The documentation of C<PERLIO_DEBUG> has been updated. | |
216 | ||
217 | =back | |
218 | ||
219 | =head3 L<perlrun> | |
220 | ||
221 | =over 4 | |
222 | ||
223 | =item * | |
224 | ||
225 | The new B<-Di> switch has been documented, and the documentation of | |
226 | C<PERLIO_DEBUG> has been updated. | |
227 | ||
228 | =back | |
229 | ||
230 | =head1 Testing | |
231 | ||
232 | =over 4 | |
233 | ||
234 | =item * | |
235 | ||
236 | A new test script, F<t/run/switchDx.t>, has been added to test that the new | |
237 | B<-Di> switch is working correctly. | |
238 | ||
239 | =back | |
240 | ||
241 | =head1 Selected Bug Fixes | |
242 | ||
243 | =over 4 | |
244 | ||
245 | =item * | |
246 | ||
247 | The C<PadlistNAMES> macro is an lvalue again. | |
248 | ||
249 | =back | |
250 | ||
251 | =head1 Acknowledgements | |
252 | ||
253 | Perl 5.22.3 represents approximately 9 months of development since Perl 5.22.2 | |
254 | and contains approximately 4,400 lines of changes across 240 files from 20 | |
255 | authors. | |
256 | ||
257 | Excluding auto-generated files, documentation and release tools, there were | |
258 | approximately 2,200 lines of changes to 170 .pm, .t, .c and .h files. | |
259 | ||
260 | Perl continues to flourish into its third decade thanks to a vibrant community | |
261 | of users and developers. The following people are known to have contributed | |
262 | the improvements that became Perl 5.22.3: | |
263 | ||
264 | Aaron Crane, Abigail, Alex Vandiver, Aristotle Pagaltzis, Chad Granum, Chris | |
265 | 'BinGOs' Williams, Craig A. Berry, David Mitchell, Father Chrysostomos, James E | |
266 | Keenan, Jarkko Hietaniemi, Karen Etheridge, Karl Williamson, Matthew Horsfall, | |
267 | Niko Tyni, Ricardo Signes, Sawyer X, Stevan Little, Steve Hay, Tony Cook. | |
268 | ||
269 | The list above is almost certainly incomplete as it is automatically generated | |
270 | from version control history. In particular, it does not include the names of | |
271 | the (very much appreciated) contributors who reported issues to the Perl bug | |
272 | tracker. | |
273 | ||
274 | Many of the changes included in this version originated in the CPAN modules | |
275 | included in Perl's core. We're grateful to the entire CPAN community for | |
276 | helping Perl to flourish. | |
277 | ||
278 | For a more complete list of all of Perl's historical contributors, please see | |
279 | the F<AUTHORS> file in the Perl source distribution. | |
280 | ||
281 | =head1 Reporting Bugs | |
282 | ||
283 | If you find what you think is a bug, you might check the articles recently | |
284 | posted to the comp.lang.perl.misc newsgroup and the Perl bug database at | |
285 | https://rt.perl.org/ . There may also be information at http://www.perl.org/ , | |
286 | the Perl Home Page. | |
287 | ||
288 | If you believe you have an unreported bug, please run the L<perlbug> program | |
289 | included with your release. Be sure to trim your bug down to a tiny but | |
290 | sufficient test case. Your bug report, along with the output of C<perl -V>, | |
291 | will be sent off to perlbug@perl.org to be analysed by the Perl porting team. | |
292 | ||
293 | If the bug you are reporting has security implications, which make it | |
294 | inappropriate to send to a publicly archived mailing list, then please send it | |
295 | to perl5-security-report@perl.org. This points to a closed subscription | |
296 | unarchived mailing list, which includes all the core committers, who will be | |
297 | able to help assess the impact of issues, figure out a resolution, and help | |
298 | co-ordinate the release of patches to mitigate or fix the problem across all | |
299 | platforms on which Perl is supported. Please only use this address for | |
300 | security issues in the Perl core, not for modules independently distributed on | |
301 | CPAN. | |
302 | ||
303 | =head1 SEE ALSO | |
304 | ||
305 | The F<Changes> file for an explanation of how to view exhaustive details on | |
306 | what changed. | |
307 | ||
308 | The F<INSTALL> file for how to build Perl. | |
309 | ||
310 | The F<README> file for general stuff. | |
311 | ||
312 | The F<Artistic> and F<Copying> files for copyright information. | |
313 | ||
314 | =cut |