Medusa audit wrappers recurse into themselves on both backends
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
Research direction
Start in Medusa.pm around MODIFY_CODE_ATTRIBUTES and line 166, then run the existing suite on both the JVM and interpreter backends to observe the recursion after the first three tests. Add the requested project-owned regression coverage for one wrapper invocation and an original call count of one, while keeping issue #1222's deep-recursion warning behavior independently testable.
Written by the indexing model from the issue text.
Description
Summary
Medusa 0.05 enters runaway recursion under PerlOnJava when an :Audit-wrapped subroutine invokes the captured original code reference. The upstream suite passes completely under system Perl.
This is distinct from issue #1222: #1222 covers missing Perl-compatible warning delivery for finite recursion, while this failure does not complete because the wrapper repeatedly calls itself.
Reproduction
CPAN random tester run: 20260918-141920-96054
Distribution: Medusa 0.05
The exact missing prerequisites were installed into an isolated library for the system-Perl comparison:
Data::UUID1.227Data::GUID0.051
(Sub::Exporter and Sub::Install were already available from system Perl.)
System Perl 5.42.2:
All tests successful.
Files=12, Tests=55
Result: PASS
PerlOnJava JVM backend:
t/00-load.t ............. ok
t/01-logger.t ........... ok
t/02-medusa-import.t .... ok
Deep recursion on subroutine "__ANON__" at Medusa.pm line 166.
The test process does not complete within the bounded tester timeout. The interpreter backend reproduces the same warning and nontermination after the same three tests.
Relevant code
Medusa.pm installs an anonymous wrapper from MODIFY_CODE_ATTRIBUTES:
*{"${caller}::$meth"} = sub {
...
my @out = $code->(@_);
...
return wantarray ? @out : shift @out;
};
The failure occurs at the $code->(@_) call (line 166). Under native Perl, $code continues to refer to the original subroutine. Under PerlOnJava, the captured reference appears to resolve back to the newly installed wrapper, causing recursive self-invocation.
Impact
Modules using Perl code attributes and runtime subroutine replacement can hang or hit the tester timeout on both PerlOnJava execution backends. The failure affects normal Medusa audit behavior, not merely warning formatting.
Expected behavior
The wrapper should invoke the original subroutine exactly once, log its return value, and allow the remaining Medusa tests to complete. The captured code reference must remain stable after the package symbol is replaced.
Please add a focused project-owned regression test for wrapping a subroutine through MODIFY_CODE_ATTRIBUTES, invoking the wrapper, and confirming that the original implementation is called once on both JVM and interpreter backends. Also verify that the related deep-recursion warning behavior in issue #1222 remains independently testable.
- Dominant language
- Perl
- Stars
- 64
- Forks
- 6
- Avg merge
- 5h 25m
- Merged PRs (30d)
- 157
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from fglock/PerlOnJava
-
area:cpan-port area:unicode bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
fglock/PerlOnJava#1341 ·
-
area:cpan-port bug
Difficulty 4/5 3-5 days Newbie friendliness 44/100
fglock/PerlOnJava#1459 ·
-
area:cpan-port bug
Difficulty 3/5 1-2 days Newbie friendliness 72/100
fglock/PerlOnJava#1457 ·
-
bug high-impact
Difficulty 3/5 1-2 days Newbie friendliness 67/100
fglock/PerlOnJava#1456 · 1 comment ·
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 72/100
fglock/PerlOnJava#1455 ·
All issues in fglock/PerlOnJava
Similar issues
-
1.severity: security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
api7/lua-resty-saml#63 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100