From d3f94da671f14731927d20f672a39e9ffffe41ee Mon Sep 17 00:00:00 2001 From: Todd Rinaldo Date: Thu, 31 Mar 2016 17:04:53 -0500 Subject: [PATCH 2/3] Remove "." from default @INC when default_inc_excludes_dot is set (not default). Perl now provides a way to build perl without . in @INC by default. If you want this feature, you can build with -Ddefault_inc_excludes_dot Because the testing / make process for perl modules do not function well with . missing from @INC, Perl now supports the environment variable PERL_USE_UNSAFE_INC=1 which makes Perl behave as it previously did, returning . to @INC in all child processes. WARNING: PERL_USE_UNSAFE_INC has been provided during the perl 5.25 development cycle and is not guaranteed to function in perl 5.26. Update unit tests and default value files to work with the new %Config variable "default_inc_excludes_dot" --- Configure | 25 +++++++++++++++++++++++++ Cross/config.sh-arm-linux | 1 + NetWare/config.wc | 1 + Porting/config.sh | 1 + config_h.SH | 6 ++++++ configure.com | 1 + perl.c | 9 +++++++-- plan9/config_sh.sample | 1 + symbian/config.sh | 1 + t/run/runenv.t | 9 +++++++-- uconfig.h | 7 +++++++ uconfig.sh | 1 + uconfig64.sh | 1 + win32/config.ce | 1 + win32/config.gc | 1 + win32/config.vc | 1 + 16 files changed, 63 insertions(+), 4 deletions(-) diff --git a/Configure b/Configure index 818ab8e..14aa692 100755 --- a/Configure +++ b/Configure @@ -1389,6 +1389,8 @@ vendorscriptexp='' versiononly='' yacc='' yaccflags='' +default_inc_excludes_dot='' + CONFIG='' : Detect odd OSs @@ -5106,6 +5108,28 @@ rp='What is the file extension used for shared libraries?' . ./myread so="$ans" +: Include . in @INC +$cat << EOM + +Historically Perl has provided a final fallback of the current working +directory '.' when searching for a library. This, however, can lead to +problems when a Perl program which loads optional modules is called from +a shared directory. This can lead to executing unexpected code. + +EOM + +case "$default_inc_excludes_dot" in + $define|true|[yY]*) dflt="n";; + *) dflt='y';; +esac + +rp='Provide '.' in @INC by default? ' +. ./myread +case "$ans" in + [nN]*|define) default_inc_excludes_dot="$define" ;; + *) default_inc_excludes_dot="$undef" ;; +esac + : Does target system insist that shared library basenames are unique $cat << EOM @@ -25364,6 +25388,7 @@ vi='$vi' xlibpth='$xlibpth' yacc='$yacc' yaccflags='$yaccflags' +default_inc_excludes_dot='$default_inc_excludes_dot' zcat='$zcat' zip='$zip' EOT diff --git a/Cross/config.sh-arm-linux b/Cross/config.sh-arm-linux index 8b3f5c0..9e58088 100644 --- a/Cross/config.sh-arm-linux +++ b/Cross/config.sh-arm-linux @@ -624,6 +624,7 @@ db_prefixtype='size_t' db_version_major='' db_version_minor='' db_version_patch='' +default_inc_excludes_dot='' direntrytype='struct dirent' dlext='so' dlsrc='dl_dlopen.xs' diff --git a/NetWare/config.wc b/NetWare/config.wc index d61924e..f13474e 100644 --- a/NetWare/config.wc +++ b/NetWare/config.wc @@ -615,6 +615,7 @@ db_version_minor='0' db_version_patch='0' def_perlroot='sys:\perl\scripts' def_temp='sys:\perl\temp' +default_inc_excludes_dot='' direntrytype='DIR' dlext='nlm' dlsrc='dl_netware.xs' diff --git a/Porting/config.sh b/Porting/config.sh index 4f6e643..cebac42 100644 --- a/Porting/config.sh +++ b/Porting/config.sh @@ -637,6 +637,7 @@ db_prefixtype='int' db_version_major='1' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct dirent' dlext='bundle' dlsrc='dl_dlopen.xs' diff --git a/config_h.SH b/config_h.SH index 099f92a..91ff58d 100755 --- a/config_h.SH +++ b/config_h.SH @@ -1452,6 +1452,12 @@ sed <$CONFIG_H -e 's!^#undef\(.*/\)\*!/\*#define\1 \*!' -e 's!^#un #define BIN_EXP "$binexp" /**/ #define PERL_RELOCATABLE_INC "$userelocatableinc" /**/ +/* DEFAULT_INC_EXCLUDES_DOT: + * This symbol, when defined, removes the legacy default behavior of including + * . at the end of @INC. + */ +#$default_inc_excludes_dot DEFAULT_INC_EXCLUDES_DOT /**/ + /* PERL_INC_VERSION_LIST: * This variable specifies the list of subdirectories in over * which perl.c:incpush() and lib/lib.pm will automatically diff --git a/configure.com b/configure.com index 1d11fe1..b45adc4 100644 --- a/configure.com +++ b/configure.com @@ -6778,6 +6778,7 @@ $ WC "u64size='" + u64size + "'" $ WC "u64type='" + u64type + "'" $ WC "u8size='" + u8size + "'" $ WC "u8type='" + u8type + "'" +$ WC "default_inc_excludes_dot=''" $ WC "uidformat='lu'" $ WC "uidsign='1'" $ WC "uidsize='4'" diff --git a/perl.c b/perl.c index 21a8b30..b2711fe 100644 --- a/perl.c +++ b/perl.c @@ -4648,8 +4648,13 @@ S_init_perllib(pTHX) #endif #endif /* !PERL_IS_MINIPERL */ - if (!TAINTING_get) - S_incpush(aTHX_ STR_WITH_LEN("."), 0); + if (!TAINTING_get) { +#if !defined(PERL_IS_MINIPERL) && defined(DEFAULT_INC_EXCLUDES_DOT) + const char * const unsafe = PerlEnv_getenv("PERL_USE_UNSAFE_INC"); + if (unsafe && strEQ(unsafe, "1")) +#endif + S_incpush(aTHX_ STR_WITH_LEN("."), 0); + } } #if defined(DOSISH) || defined(__SYMBIAN32__) diff --git a/plan9/config_sh.sample b/plan9/config_sh.sample index a89c918..1b9d5da 100644 --- a/plan9/config_sh.sample +++ b/plan9/config_sh.sample @@ -623,6 +623,7 @@ db_prefixtype='size_t' db_version_major='' db_version_minor='' db_version_patch='' +default_inc_excludes_dot='' direntrytype='struct dirent' dlext='none' dlsrc='dl_none.xs' diff --git a/symbian/config.sh b/symbian/config.sh index b311521..999447a 100644 --- a/symbian/config.sh +++ b/symbian/config.sh @@ -570,6 +570,7 @@ db_prefixtype='size_t' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct dirent' dlext='dll' dlsrc='dl_symbian.xs' diff --git a/t/run/runenv.t b/t/run/runenv.t index 8861a3d..2a1fcbf 100644 --- a/t/run/runenv.t +++ b/t/run/runenv.t @@ -285,8 +285,13 @@ is ($err, '', 'No errors when determining @INC'); my @default_inc = split /\n/, $out; -ok ! grep { $_ eq '.' } @default_inc, '. is not in @INC'; -#is ($default_inc[-1], '.', '. is last in @INC'); +# Based on the default_inc_excludes_dot Configuration variable, we either do or don't expect . to be in the default @INC. +if ( $Config{default_inc_excludes_dot} && $Config{default_inc_excludes_dot} eq 'define' ) { + ok( ( !grep { $_ eq '.' } @default_inc ), '. is not in @INC' ); +} +else { + ok( ( grep { $_ eq '.' } @default_inc ), '. is in @INC' ); +} my $sep = $Config{path_sep}; foreach (['nothing', ''], diff --git a/uconfig.h b/uconfig.h index a02560f..1c60bbd 100644 --- a/uconfig.h +++ b/uconfig.h @@ -1177,6 +1177,13 @@ * C99-style static inline. That is, the function can't be called * from another translation unit. */ + + +/* DEFAULT_INC_EXCLUDES_DOT: + * This symbol, when defined, causes @INC to include . as a final fallback. + */ +#define DEFAULT_INC_EXCLUDES_DOT /**/ + /* PERL_STATIC_INLINE: * This symbol gives the best-guess incantation to use for static * inline functions. If HAS_STATIC_INLINE is defined, this will diff --git a/uconfig.sh b/uconfig.sh index edc36db..df77b08 100644 --- a/uconfig.sh +++ b/uconfig.sh @@ -561,6 +561,7 @@ db_prefixtype='size_t' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct dirent' doubleinfbytes='0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x7f' doublekind='3' diff --git a/uconfig64.sh b/uconfig64.sh index df18372..39e8751 100644 --- a/uconfig64.sh +++ b/uconfig64.sh @@ -562,6 +562,7 @@ db_prefixtype='size_t' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct dirent' doubleinfbytes='0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x7f' doublekind='3' diff --git a/win32/config.ce b/win32/config.ce index 8f68ddd..70b4b4a 100644 --- a/win32/config.ce +++ b/win32/config.ce @@ -611,6 +611,7 @@ db_prefixtype='int' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct direct' dlext='dll' dlsrc='dl_win32.xs' diff --git a/win32/config.gc b/win32/config.gc index 69a21a2..79b2f5d 100644 --- a/win32/config.gc +++ b/win32/config.gc @@ -612,6 +612,7 @@ db_prefixtype='int' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct direct' dlext='dll' dlltool='~ARCHPREFIX~dlltool' diff --git a/win32/config.vc b/win32/config.vc index 50d2a92..3a8aaec 100644 --- a/win32/config.vc +++ b/win32/config.vc @@ -612,6 +612,7 @@ db_prefixtype='int' db_version_major='0' db_version_minor='0' db_version_patch='0' +default_inc_excludes_dot='' direntrytype='struct direct' dlext='dll' dlsrc='dl_win32.xs' -- 2.10.1