JVM backend swallows tainted eval security errors under -T

Abierto
  • ¿Algo no está bien?
#1,981 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java, perl
Área
backend, security

Línea de trabajo

Start with RuntimeCode.rejectTaintedEval and the EVAL_STRING opcode's eval-block handler, then compare how the interpreter backend propagates the error. Reproduce the failure with Text-Template 1.61's t/taint.t under -T on the JVM backend. Done means the tainted eval security error escapes the attempted eval and the eight JVM failures pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

area:backend bug

Summary

The JVM backend lets a string eval catch the taint-mode security error raised for tainted eval source. Under system Perl, the error propagates out of that inner eval; the interpreter backend also propagates it. In the JVM backend, the eval failure is instead captured as $@, allowing the caller to treat the tainted template fragment as an ordinary template error and continue.

This discrepancy causes eight failures in Text-Template 1.61's t/taint.t on the JVM backend, while the same test passes on the interpreter backend and all 21 tests pass under system Perl 5.42.2. The regression is included in archived CPAN run 20261104-151051-20617.

Root cause

RuntimeCode.rejectTaintedEval raises PerlCompilerException for tainted eval source while taint mode is active. In the JVM execution path, the EVAL_STRING opcode's surrounding eval-block handler catches that exception and calls WarnDie.catchEval, converting the forbidden inner-eval compilation into an ordinary $@ result. Perl's taint rule requires this particular security error to escape the eval whose source is tainted so an enclosing eval (or caller) sees the failure. The interpreter path already has the expected propagation behavior.

Expected behavior

An eval of tainted source under -T must not suppress its own taint violation. A caller may catch the propagated error outside the attempted eval, but the attempted eval itself must not turn it into a normal recoverable $@ result.

Lenguaje dominante
Perl
Estrellas
65
Forks
8
Merge medio
5 h 45 min
PR fusionados (30 d)
184

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de fglock/PerlOnJava

Todos los issues de fglock/PerlOnJava

Issues similares

Más issues de Perl

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.