From e54487fc63f3eb23daf412366fd652041b202731 Mon Sep 17 00:00:00 2001 From: Toddr Bot Date: Tue, 7 Apr 2026 05:04:05 +0000 Subject: [PATCH 1/4] test: add PoC for code injection vulnerability in digest-bench eval "require $mod" allows arbitrary Perl execution when the module name is attacker-controlled. This test proves it by injecting code that creates a canary file after a valid require statement. Co-Authored-By: Claude Opus 4.6 --- t/security.t | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/t/security.t b/t/security.t index 5cba122..c2439e0 100644 --- a/t/security.t +++ b/t/security.t @@ -1,14 +1,29 @@ #!/usr/bin/env perl -# Digest->new() had an exploitable eval +# Security tests: eval-based require patterns are exploitable use strict; use warnings; -use Test::More tests => 1; +use Test::More tests => 2; use Digest; +# Test 1: Digest->new() had an exploitable eval $LOL::PWNED = 0; eval { Digest->new(q[MD;5;$LOL::PWNED = 42]) }; -is $LOL::PWNED, 0; +is $LOL::PWNED, 0, 'Digest->new does not eval-inject via module name'; + +# Test 2: digest-bench must not allow code injection via module name +# With eval "require $mod", an attacker can append arbitrary Perl after a +# valid module name. The payload executes inside the eval and can create +# files, open sockets, etc. A safe bare require prevents this entirely. +{ + use File::Temp qw(tmpnam); + my $canary = tmpnam(); + # Payload: require a real module, then create a canary file as proof of execution + my $payload = qq{Digest::MD5; open my \\\$fh, '>', '$canary'}; + `$^X digest-bench "$payload" 2>&1`; + ok(! -e $canary, 'digest-bench does not execute injected code in module name'); + unlink $canary if -e $canary; # cleanup if test fails +} From a204d318ccc23e2234715172c489a3df4dff908f Mon Sep 17 00:00:00 2001 From: Toddr Bot Date: Tue, 7 Apr 2026 05:04:25 +0000 Subject: [PATCH 2/4] fix: replace eval "require $mod" with safe bare require in digest-bench The eval-based require allowed arbitrary code execution when the module name argument contained injected Perl code (e.g., "Digest::MD5; system(...)"). Replace with the same safe pattern used in Digest.pm: convert :: to / in the module name and use bare require, which only loads files. Also declare $a with my to avoid clobbering the special sort variable. Co-Authored-By: Claude Opus 4.6 --- digest-bench | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/digest-bench b/digest-bench index f828b2b..e9828b1 100755 --- a/digest-bench +++ b/digest-bench @@ -5,10 +5,11 @@ die unless @ARGV; my ( $mod, @args ) = @ARGV; -eval "require $mod"; -die $@ if $@; +my $pm_file = $mod . ".pm"; +$pm_file =~ s{::}{/}g; +require $pm_file; -$a = substr( join( "", "a" .. "z", ) x 800, 0, 8 * 1024 ); +my $a = substr( join( "", "a" .. "z", ) x 800, 0, 8 * 1024 ); my $count = 4 * 1024; use Time::HiRes qw(time); From b72b62ec9f1056f2d1f254a6091ace483b192534 Mon Sep 17 00:00:00 2001 From: Toddr Bot Date: Sat, 11 Apr 2026 12:28:23 +0000 Subject: [PATCH 3/4] ci: fix broken test matrix and update actions Docker Hub deprecated Image Format v1, breaking pulls for perl:5.8 through perl:5.24 containers on GitHub Actions. This caused all CI runs (including main branch) to fail on those versions. - Remove Perl 5.8-5.24 from matrix (Docker images no longer pullable) - Add Perl 5.34, 5.36, 5.38, 5.40 to matrix - Update actions/checkout from v2 to v4 The module still supports Perl 5.006+ at runtime; only CI coverage of versions older than 5.26 is affected by this infrastructure change. Supersedes #14 and #15. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/testsuite.yml | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/testsuite.yml b/.github/workflows/testsuite.yml index 3cd0e3e..aae57d9 100644 --- a/.github/workflows/testsuite.yml +++ b/.github/workflows/testsuite.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - run: perl -V - name: install dependencies uses: perl-actions/install-with-cpm@v1 @@ -46,26 +46,21 @@ jobs: matrix: perl-version: [ + "5.40", + "5.38", + "5.36", + "5.34", "5.32", "5.30", "5.28", "5.26", - "5.24", - "5.22", - "5.20", - "5.18", - "5.16", - "5.14", - "5.12", - "5.10", - "5.8", ] container: image: perl:${{ matrix.perl-version }} steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - run: perl -V - name: install dependencies uses: perl-actions/install-with-cpm@v1 @@ -93,7 +88,7 @@ jobs: perl-version: [latest] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - run: perl -V - name: install dependencies uses: perl-actions/install-with-cpm@v1 From bcba0e3f42f15ad667d5d34833d3ac4a759e7572 Mon Sep 17 00:00:00 2001 From: Toddr Bot Date: Wed, 22 Apr 2026 12:44:02 +0000 Subject: [PATCH 4/4] ci: modernize CI matrix and add Windows testing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consolidates CI improvements into a single change: - Remove Perl 5.8–5.24 from matrix (Docker Hub deprecated Image Format v1) - Add Perl 5.34, 5.36, 5.38, 5.40 to linux matrix - Update actions/checkout v2 → v4 (Node.js 12 → 20) - Add Windows CI job using Strawberry Perl Supersedes #14, #15, #18, and #20. Co-Authored-By: Claude Opus 4.6 --- .github/workflows/testsuite.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/.github/workflows/testsuite.yml b/.github/workflows/testsuite.yml index aae57d9..23e101e 100644 --- a/.github/workflows/testsuite.yml +++ b/.github/workflows/testsuite.yml @@ -72,6 +72,37 @@ jobs: - name: make test run: make test + windows: + needs: [ubuntu] + env: + PERL_USE_UNSAFE_INC: 0 + AUTHOR_TESTING: 1 + AUTOMATED_TESTING: 1 + RELEASE_TESTING: 1 + + runs-on: windows-latest + + strategy: + fail-fast: false + matrix: + perl-version: [latest] + + steps: + - uses: actions/checkout@v4 + - name: Set up Perl + uses: shogo82148/actions-setup-perl@v1 + with: + perl-version: ${{ matrix.perl-version }} + - run: perl -V + - name: install dependencies + uses: perl-actions/install-with-cpm@v1 + with: + cpanfile: "cpanfile" + - name: Makefile.PL + run: perl Makefile.PL + - name: make test + run: gmake test + macOS: needs: [ubuntu] env: