Skip to content

Harden module loading #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
salva wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Harden module loading #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4c2f3ed
Harden module loading
Jun 4, 2026
4e504a6
Handle undefined module names
Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions MANIFEST
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ t/test_server_key.pub
t/test_user_key
t/test_user_key.pub
t/known_hosts
t/module-loader.t
t/quoting.t
t/uri.t
examples/expect.pl
Expand Down
16 changes: 8 additions & 8 deletions lib/Net/OpenSSH/ModuleLoader.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,23 +11,23 @@ our @EXPORT = qw(_load_module);

sub _load_module {
my ($module, $version) = @_;
defined $module or croak "bad Perl module name";
$module =~ /\A[A-Za-z_]\w*(?:::\w+)*\z/
or croak "bad Perl module name $module";
Comment on lines 13 to +16

@salva salva Jun 4, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in commit 4e504a6 by handling undefined module names before applying the regex, with a regression assertion in t/module-loader.t.

$loaded_module{$module} ||= do {
my $err;
do {
local ($@, $SIG{__DIE__});
my $ok = eval "require $module; 1";
(my $path = "$module.pm") =~ s!::!/!g;
my $ok = eval { require $path; 1 };
$err = $@;
$ok;
} or croak "unable to load Perl module $module: $err";
};
if (defined $version) {
my $mv = do {
local ($@, $SIG{__DIE__});
eval "\$${module}::VERSION";
} || 0;
(my $mv1 = $mv) =~ s/_\d*$//;
croak "$module version $version required, $mv is available"
if $mv1 < $version;
local ($@, $SIG{__DIE__});
eval { $module->VERSION($version); 1 }
or croak $@ || "$module version $version required";
}
1
}
Expand Down
34 changes: 34 additions & 0 deletions t/module-loader.t
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
#!/usr/bin/perl

use strict;
use warnings;

use Test::More tests => 6;

use Net::OpenSSH::ModuleLoader;

ok(_load_module('strict'), 'loads a valid module name');

eval { _load_module('strict; die "boom"') };
like($@, qr/bad Perl module name/, 'rejects unsafe module names');

eval { _load_module(undef) };
like($@, qr/bad Perl module name/, 'rejects undefined module names without warnings');

eval { _load_module('strict', 999_999) };
like($@, qr/strict version 999999 required|strict version 999999 required--this is only version/,
'uses standard VERSION checks for too-new requirements');

{
package Test::Net::OpenSSH::ModuleLoader::Versioned;
our $VERSION = '1.02';
}
Comment on lines +22 to +25

@salva salva Jun 4, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This concern does not hold for the test as written. The package Test::Net::OpenSSH::ModuleLoader::Versioned; declaration is inside a bare block, and the later unqualified ok/like calls continue to resolve correctly. The test passes after the new undef-name coverage:\n\nperl -Ilib t/module-loader.t\n\nResult: 1..6 and all assertions pass.


$INC{'Test/Net/OpenSSH/ModuleLoader/Versioned.pm'} = __FILE__;

ok(_load_module('Test::Net::OpenSSH::ModuleLoader::Versioned', '1.01'),
'accepts a sufficient version');

eval { _load_module('Test::Net::OpenSSH::ModuleLoader::Versioned', '1.03') };
like($@, qr/Test::Net::OpenSSH::ModuleLoader::Versioned version 1.03 required/,
'rejects an insufficient version');