On Tue, 7 Dec 2004, Stas Bekman wrote:
> Randy Kobes wrote:
[ ... ]
> > ==============================================================
> > Index: lib/Apache/TestConfig.pm
> > ===================================================================
> > --- lib/Apache/TestConfig.pm (revision 110064)
> > +++ lib/Apache/TestConfig.pm (working copy)
> > @@ -1043,7 +1043,8 @@
> > # Temporarily untaint PATH
> > (local $ENV{PATH}) = ( $ENV{PATH} =~ /(.*)/ );
> > # -T disallows relative directories in the PATH
> > - $ENV{PATH} = join ':', grep !/^\./, split /:/, $ENV{PATH};
> > + my $sep = WIN32 ? ';' : ':';
> > + $ENV{PATH} = join $sep, grep !/^\./, split /$sep/, $ENV{PATH};
> >
> > # launder for -T
> > $cmd = $1 if $cmd =~ /(.*)/;
> > @@ -1657,7 +1658,12 @@
> > return unless $self->{APXS};
> > my $val;
> > unless (exists $self->{_apxs}{$q}) {
> > - local @ENV{ qw(PATH IFS CDPATH ENV BASH_ENV) };
> > + local @ENV{ qw(IFS CDPATH ENV BASH_ENV) };
> > + # Temporarily untaint PATH
> > + (local $ENV{PATH}) = ( $ENV{PATH} =~ /(.*)/ );
> > + # -T disallows relative directories in the PATH
> > + my $sep = WIN32 ? ';' : ':';
> > + $ENV{PATH} = join $sep, grep !/^\./, split /$sep/, $ENV{PATH};
> > my $devnull = devnull();
> > my $apxs = shell_ready($self->{APXS});
> > $val = qx($apxs -q $q 2>$devnull);
>
> As soon as you see dup like this, think refactoring :) e.g. add
> untaint_path(), that does the work and call it:
>
> local $ENV{PATH}) = untaint_path($ENV{PATH});
>
> Otherwise +1.
>
> And of course this wrapper should probably used in open_cmd too!
OK, I'll do that - thanks!
> Also is there some File::Spec thingy that defines record
> separator in paths?
I looked through there - there's not one specifically
defined. There are special cases for various platforms:
Mac => uses ',', but needs $ENV{Commands}, not $ENV{PATH}
OS2 => uses ';', but also translates '\' to '/'
VMS => uses a different $ENV variable
So some of these (eg, Mac and VMS) would require special
handling just to get at the equivalent of $ENV{PATH}.
Is leaving it just as is OK for the moment (using ';' for
WIN32, ':' otherwise), and if someone has problems with it,
we can fix it then?
Also, I haven't tried it yet, but just to make sure the
email messages go to the right place - can one do a commit
to Apache-Test from within modperl-2.0 svn (from within
the Apache-Test subdirectory)?
--
best regards,
randy
