urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

web commit by adb

master
Joey Hess 2008-01-06 18:25:43 -05:00
parent e92c51f5e5
commit 27261da09b
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
doc/bugs/taint_issue_with_regular_expressions.mdwn
View File

@ -19,4 +19,13 @@ which is exactly the same regular expression drawn out as a constant. It appear
> checking in the debian package. You can do the same by building ikiwiki
> with NOTAINT=1. :-( --[[Joey]]
[[tag done]]
----------------
Continuing to dig into the problem I reported, it may not be taint after all. Running strings on the ikiwiki.cgi wrapper, I see stuff like:
'wiki_file_regexp' => bless( do{\(my $o = undef)}, 'Regexp' )
without any payload of the actual regexp, and that would also certainly also have the observed effect of the regexps being completely broken while running in CGI mode. This seems to implicate Data::Dumper (2.101). After upgrading Data::Dumper to 2.121 I get:
'wiki_file_regexp' => qr/(?-xism:(^[-[:alnum:]_.:\/+]+$))/
This would call for at most an installation prerequisite of Data::Dumper >= 1.121. A look at the module's changelog shows that no intervening versions were actually released, so 1.121 would be the minimal good one.