Re: Potentially insecure Perl scripts

[Colin Watson <cjwatson@debian.org>]

On Thu, Jan 24, 2019 at 02:49:29PM -0500, Mark Fowler wrote:
> On Thu, Jan 24, 2019 at 10:18 AM Ian Jackson <
> ijackson@chiark.greenend.org.uk> wrote:
> > To the Debian Perl maintainers: if I make a patch to make
> >   -p -n <>
> > use the 3-argument form of open (or equivalent), will you apply it ?
> >
> > To the Debian security team: would you ship it in a security update ?
> 
> Wouldn't a less drastic approach be to change the vulnerable scripts to use
> <<>> instead of <>?

Do you have a proposal for enumerating all the vulnerable scripts?

Also, <<>> doesn't work if your script expects to continue to support
"-" to mean stdin, because it turns that off along with all the rather
more dangerous magic.  In the case of groff, "-" was specifically
documented in the manual pages of the relevant programs; so I made
essentially the following transformation:

  while (<>) {
    ...
  }

... into:

  unshift @ARGV, '-' unless @ARGV;
  foreach my $filename (@ARGV) {
    my $input;
    if ($filename eq '-') {
      $input = \*STDIN;
    } elsif (not open $input, '<', $filename) {
      warn $!;
      next;
    }
    while (<$input>) {
      ...
    }
  }

A bit tedious, but seems workable.

-- 
Colin Watson                                       [cjwatson@debian.org]