From 0ec237eb221ba328c51073e7f7ea902d1c5592fa Mon Sep 17 00:00:00 2001 From: Andrew Fresh Date: Mon, 14 Aug 2017 13:46:20 +0000 Subject: Import perl-5.24.2 --- .../perl/dist/base/t/lib/BaseIncMandatory.pm | 9 + .../perl/dist/base/t/lib/BaseIncOptional.pm | 13 + gnu/usr.bin/perl/import_log-DmXIpUUul | 0 gnu/usr.bin/perl/pod/perl5223delta.pod | 314 +++++++++++++++++++++ gnu/usr.bin/perl/pod/perl5241delta.pod | 308 ++++++++++++++++++++ 5 files changed, 644 insertions(+) create mode 100644 gnu/usr.bin/perl/dist/base/t/lib/BaseIncMandatory.pm create mode 100644 gnu/usr.bin/perl/dist/base/t/lib/BaseIncOptional.pm create mode 100644 gnu/usr.bin/perl/import_log-DmXIpUUul create mode 100644 gnu/usr.bin/perl/pod/perl5223delta.pod create mode 100644 gnu/usr.bin/perl/pod/perl5241delta.pod (limited to 'gnu') diff --git a/gnu/usr.bin/perl/dist/base/t/lib/BaseIncMandatory.pm b/gnu/usr.bin/perl/dist/base/t/lib/BaseIncMandatory.pm new file mode 100644 index 00000000000..9e0718c60e5 --- /dev/null +++ b/gnu/usr.bin/perl/dist/base/t/lib/BaseIncMandatory.pm @@ -0,0 +1,9 @@ +package BaseIncMandatory; + +BEGIN { package main; + is $INC[-1], '.', 'trailing dot remains in @INC during mandatory module load from base'; + ok eval('require t::lib::Dummy'), '... and modules load fine from .' or diag "$@"; + delete $INC{'t/lib/Dummy.pm'}; +} + +1; diff --git a/gnu/usr.bin/perl/dist/base/t/lib/BaseIncOptional.pm b/gnu/usr.bin/perl/dist/base/t/lib/BaseIncOptional.pm new file mode 100644 index 00000000000..e5bf0174efd --- /dev/null +++ b/gnu/usr.bin/perl/dist/base/t/lib/BaseIncOptional.pm @@ -0,0 +1,13 @@ +package BaseIncOptional; + +BEGIN { package main; + is $INC[-1], '.', 'trailing dot remains in @INC during optional module load from base'; + ok eval('require t::lib::Dummy'), '... and modules load fine from .' or diag "$@"; + delete $INC{'t/lib/Dummy.pm'}; +} + +use lib 't/lib/on-head'; + +push @INC, 't/lib/on-tail'; + +1; diff --git a/gnu/usr.bin/perl/import_log-DmXIpUUul b/gnu/usr.bin/perl/import_log-DmXIpUUul new file mode 100644 index 00000000000..e69de29bb2d diff --git a/gnu/usr.bin/perl/pod/perl5223delta.pod b/gnu/usr.bin/perl/pod/perl5223delta.pod new file mode 100644 index 00000000000..e1322b7eb45 --- /dev/null +++ b/gnu/usr.bin/perl/pod/perl5223delta.pod @@ -0,0 +1,314 @@ +=encoding utf8 + +=head1 NAME + +perl5223delta - what is new for perl v5.22.3 + +=head1 DESCRIPTION + +This document describes differences between the 5.22.2 release and the 5.22.3 +release. + +If you are upgrading from an earlier release such as 5.22.1, first read +L, which describes differences between 5.22.1 and 5.22.2. + +=head1 Security + +=head2 B<-Di> switch is now required for PerlIO debugging output + +Previously PerlIO debugging output would be sent to the file specified by the +C environment variable if perl wasn't running setuid and the +B<-T> or B<-t> switches hadn't been parsed yet. + +If perl performed output at a point where it hadn't yet parsed its switches +this could result in perl creating or overwriting the file named by +C even when the B<-T> switch had been supplied. + +Perl now requires the B<-Di> switch to produce PerlIO debugging output. By +default this is written to C, but can optionally be redirected to a +file by setting the C environment variable. + +If perl is running setuid or the B<-T> switch was supplied C is +ignored and the debugging output is sent to C as for any other B<-D> +switch. + +=head2 Core modules and tools no longer search F<"."> for optional modules + +The tools and many modules supplied in core no longer search the default +current directory entry in L|perlvar/@INC> for optional modules. For +example, L will remove the final F<"."> from C<@INC> before trying to +load L. + +This prevents an attacker injecting an optional module into a process run by +another user where the current directory is writable by the attacker, e.g. the +F directory. + +In most cases this removal should not cause problems, but difficulties were +encountered with L, which treats every module name supplied as optional. +These difficulties have not yet been resolved, so for this release there are no +changes to L. We hope to have a fix for L in Perl 5.22.4. + +To protect your own code from this attack, either remove the default F<"."> +entry from C<@INC> at the start of your script, so: + + #!/usr/bin/perl + use strict; + ... + +becomes: + + #!/usr/bin/perl + BEGIN { pop @INC if $INC[-1] eq '.' } + use strict; + ... + +or for modules, remove F<"."> from a localized C<@INC>, so: + + my $can_foo = eval { require Foo; } + +becomes: + + my $can_foo = eval { + local @INC = @INC; + pop @INC if $INC[-1] eq '.'; + require Foo; + }; + +=head1 Incompatible Changes + +Other than the security changes above there are no changes intentionally +incompatible with Perl 5.22.2. If any exist, they are bugs, and we request +that you submit a report. See L below. + +=head1 Modules and Pragmata + +=head2 Updated Modules and Pragmata + +=over 4 + +=item * + +L has been upgraded from version 2.04 to 2.04_01. + +=item * + +L has been upgraded from version 0.39 to 0.39_01. + +=item * + +L has been upgraded from version 2.11 to 2.11_01. + +=item * + +L has been upgraded from version 1.17 to 1.17_01. + +=item * + +L has been upgraded from version 5.95 to 5.95_01. + +=item * + +L has been upgraded from version 2.72 to 2.72_01. + +=item * + +L has been upgraded from version 1.20 to 1.20_01. + +=item * + +L has been upgraded from version 7.04_01 to 7.04_02. + +=item * + +L has been upgraded from version 0.48 to 0.48_01. + +=item * + +L has been upgraded from version 3.56_01 to 3.56_02. + +=item * + +L has been upgraded from version 0.054 to 0.054_01. + +=item * + +L has been upgraded from version 1.35 to 1.35_01. + +=item * + +The IO-Compress modules have been upgraded from version 2.068 to 2.068_001. + +=item * + +L has been upgraded from version 0.92 to 0.92_01. + +=item * + +L has been upgraded from version 2.27300 to 2.27300_01. + +=item * + +L has been upgraded from version 1.26 to 1.26_01. + +=item * + +L has been upgraded from version 0.21 to 0.21_01. + +=item * + +L has been upgraded from version 1.03 to 1.03_01. + +=item * + +L has been upgraded from version 5.20160429 to 5.20170114_22. + +=item * + +L has been upgraded from version 2.43 to 2.43_01. + +=item * + +L has been upgraded from version 1.4414 to 1.4414_001. + +=item * + +L has been upgraded from version 1.22 to 1.2201. + +=item * + +L has been upgraded from version 3.25 to 3.25_01. + +=item * + +L has been upgraded from version 2.53_01 to 2.53_02. + +=item * + +L has been upgraded from version 0.33 to 0.33_01. + +=item * + +L has been upgraded from version 1.26 to 1.26_01. + +=item * + +L has been upgraded from version 3.35 to 3.35_01. + +=item * + +L has been upgraded from version 0.20 to 0.20_01, fixing a security +hole in which binary files could be loaded from a path outside of C<@INC>. +L<[perl #128528]|https://rt.perl.org/Public/Bug/Display.html?id=128528> + +=back + +=head1 Documentation + +=head2 Changes to Existing Documentation + +=head3 L + +=over 4 + +=item * + +The documentation of C has been updated. + +=back + +=head3 L + +=over 4 + +=item * + +The new B<-Di> switch has been documented, and the documentation of +C has been updated. + +=back + +=head1 Testing + +=over 4 + +=item * + +A new test script, F, has been added to test that the new +B<-Di> switch is working correctly. + +=back + +=head1 Selected Bug Fixes + +=over 4 + +=item * + +The C macro is an lvalue again. + +=back + +=head1 Acknowledgements + +Perl 5.22.3 represents approximately 9 months of development since Perl 5.22.2 +and contains approximately 4,400 lines of changes across 240 files from 20 +authors. + +Excluding auto-generated files, documentation and release tools, there were +approximately 2,200 lines of changes to 170 .pm, .t, .c and .h files. + +Perl continues to flourish into its third decade thanks to a vibrant community +of users and developers. The following people are known to have contributed +the improvements that became Perl 5.22.3: + +Aaron Crane, Abigail, Alex Vandiver, Aristotle Pagaltzis, Chad Granum, Chris +'BinGOs' Williams, Craig A. Berry, David Mitchell, Father Chrysostomos, James E +Keenan, Jarkko Hietaniemi, Karen Etheridge, Karl Williamson, Matthew Horsfall, +Niko Tyni, Ricardo Signes, Sawyer X, Stevan Little, Steve Hay, Tony Cook. + +The list above is almost certainly incomplete as it is automatically generated +from version control history. In particular, it does not include the names of +the (very much appreciated) contributors who reported issues to the Perl bug +tracker. + +Many of the changes included in this version originated in the CPAN modules +included in Perl's core. We're grateful to the entire CPAN community for +helping Perl to flourish. + +For a more complete list of all of Perl's historical contributors, please see +the F file in the Perl source distribution. + +=head1 Reporting Bugs + +If you find what you think is a bug, you might check the articles recently +posted to the comp.lang.perl.misc newsgroup and the Perl bug database at +https://rt.perl.org/ . There may also be information at http://www.perl.org/ , +the Perl Home Page. + +If you believe you have an unreported bug, please run the L program +included with your release. Be sure to trim your bug down to a tiny but +sufficient test case. Your bug report, along with the output of C, +will be sent off to perlbug@perl.org to be analysed by the Perl porting team. + +If the bug you are reporting has security implications, which make it +inappropriate to send to a publicly archived mailing list, then please send it +to perl5-security-report@perl.org. This points to a closed subscription +unarchived mailing list, which includes all the core committers, who will be +able to help assess the impact of issues, figure out a resolution, and help +co-ordinate the release of patches to mitigate or fix the problem across all +platforms on which Perl is supported. Please only use this address for +security issues in the Perl core, not for modules independently distributed on +CPAN. + +=head1 SEE ALSO + +The F file for an explanation of how to view exhaustive details on +what changed. + +The F file for how to build Perl. + +The F file for general stuff. + +The F and F files for copyright information. + +=cut diff --git a/gnu/usr.bin/perl/pod/perl5241delta.pod b/gnu/usr.bin/perl/pod/perl5241delta.pod new file mode 100644 index 00000000000..5c50730ec45 --- /dev/null +++ b/gnu/usr.bin/perl/pod/perl5241delta.pod @@ -0,0 +1,308 @@ +=encoding utf8 + +=head1 NAME + +perl5241delta - what is new for perl v5.24.1 + +=head1 DESCRIPTION + +This document describes differences between the 5.24.0 release and the 5.24.1 +release. + +If you are upgrading from an earlier release such as 5.22.0, first read +L, which describes differences between 5.22.0 and 5.24.0. + +=head1 Security + +=head2 B<-Di> switch is now required for PerlIO debugging output + +Previously PerlIO debugging output would be sent to the file specified by the +C environment variable if perl wasn't running setuid and the +B<-T> or B<-t> switches hadn't been parsed yet. + +If perl performed output at a point where it hadn't yet parsed its switches +this could result in perl creating or overwriting the file named by +C even when the B<-T> switch had been supplied. + +Perl now requires the B<-Di> switch to produce PerlIO debugging output. By +default this is written to C, but can optionally be redirected to a +file by setting the C environment variable. + +If perl is running setuid or the B<-T> switch was supplied C is +ignored and the debugging output is sent to C as for any other B<-D> +switch. + +=head2 Core modules and tools no longer search F<"."> for optional modules + +The tools and many modules supplied in core no longer search the default +current directory entry in L|perlvar/@INC> for optional modules. For +example, L will remove the final F<"."> from C<@INC> before trying to +load L. + +This prevents an attacker injecting an optional module into a process run by +another user where the current directory is writable by the attacker, e.g. the +F directory. + +In most cases this removal should not cause problems, but difficulties were +encountered with L, which treats every module name supplied as optional. +These difficulties have not yet been resolved, so for this release there are no +changes to L. We hope to have a fix for L in Perl 5.24.2. + +To protect your own code from this attack, either remove the default F<"."> +entry from C<@INC> at the start of your script, so: + + #!/usr/bin/perl + use strict; + ... + +becomes: + + #!/usr/bin/perl + BEGIN { pop @INC if $INC[-1] eq '.' } + use strict; + ... + +or for modules, remove F<"."> from a localized C<@INC>, so: + + my $can_foo = eval { require Foo; } + +becomes: + + my $can_foo = eval { + local @INC = @INC; + pop @INC if $INC[-1] eq '.'; + require Foo; + }; + +=head1 Incompatible Changes + +Other than the security changes above there are no changes intentionally +incompatible with Perl 5.24.0. If any exist, they are bugs, and we request +that you submit a report. See L below. + +=head1 Modules and Pragmata + +=head2 Updated Modules and Pragmata + +=over 4 + +=item * + +L has been upgraded from version 2.04 to 2.04_01. + +=item * + +L has been upgraded from version 0.42 to 0.42_01. + +=item * + +L has been upgraded from version 2.11 to 2.11_01. + +=item * + +L has been upgraded from version 1.17 to 1.17_01. + +=item * + +L has been upgraded from version 5.95 to 5.95_01. + +=item * + +L has been upgraded from version 2.80 to 2.80_01. + +=item * + +L has been upgraded from version 7.10_01 to 7.10_02. + +=item * + +L has been upgraded from version 0.48 to 0.48_01. + +=item * + +L has been upgraded from version 3.63 to 3.63_01. + +=item * + +L has been upgraded from version 0.056 to 0.056_001. + +=item * + +L has been upgraded from version 1.36 to 1.36_01. + +=item * + +The IO-Compress modules have been upgraded from version 2.069 to 2.069_001. + +=item * + +L has been upgraded from version 0.92 to 0.92_01. + +=item * + +L has been upgraded from version 2.27300 to 2.27300_01. + +=item * + +L has been upgraded from version 1.26 to 1.26_01. + +=item * + +L has been upgraded from version 0.21 to 0.21_01. + +=item * + +L has been upgraded from version 1.03 to 1.03_01. + +=item * + +L has been upgraded from version 5.20160506 to 5.20170114_24. + +=item * + +L has been upgraded from version 2.43 to 2.43_01. + +=item * + +L has been upgraded from version 1.4417 to 1.4417_001. + +=item * + +L has been upgraded from version 1.22 to 1.2201. + +=item * + +L has been upgraded from version 3.25_02 to 3.25_03. + +=item * + +L has been upgraded from version 2.56 to 2.56_01. + +=item * + +L has been upgraded from version 0.33 to 0.33_01. + +=item * + +L has been upgraded from version 1.28 to 1.28_01. + +=item * + +L has been upgraded from version 3.36 to 3.36_01. + +=item * + +L has been upgraded from version 0.21 to 0.22, fixing a security hole +in which binary files could be loaded from a path outside of C<@INC>. +L<[perl #128528]|https://rt.perl.org/Public/Bug/Display.html?id=128528> + +=back + +=head1 Documentation + +=head2 Changes to Existing Documentation + +=head3 L + +=over 4 + +=item * + +The documentation of C has been updated. + +=back + +=head3 L + +=over 4 + +=item * + +The new B<-Di> switch has been documented, and the documentation of +C has been updated. + +=back + +=head1 Testing + +=over 4 + +=item * + +A new test script, F, has been added to test that the new +B<-Di> switch is working correctly. + +=back + +=head1 Selected Bug Fixes + +=over 4 + +=item * + +The change to hashbang redirection introduced in Perl 5.24.0, whereby perl +would redirect to another interpreter (Perl 6) if it found a hashbang path +which contains "perl" followed by "6", has been reverted because it broke in +cases such as C<#!/opt/perl64/bin/perl>. + +=back + +=head1 Acknowledgements + +Perl 5.24.1 represents approximately 8 months of development since Perl 5.24.0 +and contains approximately 8,100 lines of changes across 240 files from 18 +authors. + +Excluding auto-generated files, documentation and release tools, there were +approximately 2,200 lines of changes to 170 .pm, .t, .c and .h files. + +Perl continues to flourish into its third decade thanks to a vibrant community +of users and developers. The following people are known to have contributed +the improvements that became Perl 5.24.1: + +Aaron Crane, Alex Vandiver, Aristotle Pagaltzis, Chad Granum, Chris 'BinGOs' +Williams, Craig A. Berry, Father Chrysostomos, James E Keenan, Jarkko +Hietaniemi, Karen Etheridge, Leon Timmermans, Matthew Horsfall, Ricardo Signes, +Sawyer X, Sébastien Aperghis-Tramoni, Stevan Little, Steve Hay, Tony Cook. + +The list above is almost certainly incomplete as it is automatically generated +from version control history. In particular, it does not include the names of +the (very much appreciated) contributors who reported issues to the Perl bug +tracker. + +Many of the changes included in this version originated in the CPAN modules +included in Perl's core. We're grateful to the entire CPAN community for +helping Perl to flourish. + +For a more complete list of all of Perl's historical contributors, please see +the F file in the Perl source distribution. + +=head1 Reporting Bugs + +If you find what you think is a bug, you might check the articles recently +posted to the comp.lang.perl.misc newsgroup and the Perl bug database at +L . There may also be information at +L , the Perl Home Page. + +If you believe you have an unreported bug, please run the L program +included with your release. Be sure to trim your bug down to a tiny but +sufficient test case. Your bug report, along with the output of C, +will be sent off to perlbug@perl.org to be analysed by the Perl porting team. + +If the bug you are reporting has security implications which make it +inappropriate to send to a publicly archived mailing list, then see +L for details of how to +report the issue. + +=head1 SEE ALSO + +The F file for an explanation of how to view exhaustive details on +what changed. + +The F file for how to build Perl. + +The F file for general stuff. + +The F and F files for copyright information. + +=cut -- cgit v1.2.3