1 From b6307f728a4f842a54ea96959e386c7daa92ece1 Mon Sep 17 00:00:00 2001
2 From: Tony Cook <tony@develop-help.com>
3 Date: Tue, 15 Dec 2015 10:56:54 +1100
4 Subject: [perl #126862] ensure File::Spec::canonpath() preserves taint
6 Previously the unix specific XS implementation of canonpath() would
7 return an untainted path when supplied a tainted path.
9 For the empty string case, newSVpvs() already sets taint as needed on
12 dist/PathTools/Cwd.xs | 1 +
13 dist/PathTools/t/taint.t | 19 ++++++++++++++++++-
14 2 files changed, 19 insertions(+), 1 deletion(-)
16 --- a/dist/PathTools/Cwd.xs
17 +++ b/dist/PathTools/Cwd.xs
18 @@ -535,6 +535,7 @@ THX_unix_canonpath(pTHX_ SV *path)
21 SvCUR_set(retval, o - SvPVX(retval));
26 --- a/dist/PathTools/t/taint.t
27 +++ b/dist/PathTools/t/taint.t
28 @@ -12,7 +12,7 @@ use Test::More;
34 : (skip_all => "A perl without taint support")
37 @@ -34,3 +34,20 @@ foreach my $func (@Functions) {
39 # Previous versions of Cwd tainted $^O
40 is !tainted($^O), 1, "\$^O should not be tainted";
43 + # [perl #126862] canonpath() loses taint
44 + my $tainted = substr($ENV{PATH}, 0, 0);
45 + # yes, getcwd()'s result should be tainted, and is tested above
47 + ok tainted(File::Spec->canonpath($tainted . Cwd::getcwd)),
48 + "canonpath() keeps taint on non-empty string";
49 + ok tainted(File::Spec->canonpath($tainted)),
50 + "canonpath() keeps taint on empty string";
52 + (Cwd::getcwd() =~ /^(.*)/);
54 + ok !tainted($untainted), "make sure our untainted value is untainted";
55 + ok !tainted(File::Spec->canonpath($untainted)),
56 + "canonpath() doesn't add taint to untainted string";