JVM backend swallows tainted eval security errors under -T

未关闭
  • 哪里不对？
#1,981 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
55/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
java, perl
领域
backend, security

调研方向

Start with RuntimeCode.rejectTaintedEval and the EVAL_STRING opcode's eval-block handler, then compare how the interpreter backend propagates the error. Reproduce the failure with Text-Template 1.61's t/taint.t under -T on the JVM backend. Done means the tainted eval security error escapes the attempted eval and the eight JVM failures pass.

由索引模型根据 Issue 内容生成。

描述

area:backend bug

Summary

The JVM backend lets a string eval catch the taint-mode security error raised for tainted eval source. Under system Perl, the error propagates out of that inner eval; the interpreter backend also propagates it. In the JVM backend, the eval failure is instead captured as $@, allowing the caller to treat the tainted template fragment as an ordinary template error and continue.

This discrepancy causes eight failures in Text-Template 1.61's t/taint.t on the JVM backend, while the same test passes on the interpreter backend and all 21 tests pass under system Perl 5.42.2. The regression is included in archived CPAN run 20261104-151051-20617.

Root cause

RuntimeCode.rejectTaintedEval raises PerlCompilerException for tainted eval source while taint mode is active. In the JVM execution path, the EVAL_STRING opcode's surrounding eval-block handler catches that exception and calls WarnDie.catchEval, converting the forbidden inner-eval compilation into an ordinary $@ result. Perl's taint rule requires this particular security error to escape the eval whose source is tainted so an enclosing eval (or caller) sees the failure. The interpreter path already has the expected propagation behavior.

Expected behavior

An eval of tainted source under -T must not suppress its own taint violation. A caller may catch the propagated error outside the attempted eval, but the attempted eval itself must not turn it into a normal recoverable $@ result.

主要语言
Perl
星标
65
派生
8
平均合并
5 小时 45 分钟
30 天内合并 PR
184

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

fglock/PerlOnJava 的其他 Issue

查看 fglock/PerlOnJava 的全部 Issue

相似的 Issue

更多 Perl Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。