{"action":"created","issue":{"url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/53","repository_url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness","labels_url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/53/labels{/name}","comments_url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/53/comments","events_url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/53/events","html_url":"https://github.com/Perl-Toolchain-Gang/Test-Harness/pull/53","id":168010856,"number":53,"title":"CVE-2016-1238: avoid loading optional modules from default .","user":{"login":"tonycoz","id":166429,"avatar_url":"https://avatars.githubusercontent.com/u/166429?v=3","gravatar_id":"","url":"https://api.github.com/users/tonycoz","html_url":"https://github.com/tonycoz","followers_url":"https://api.github.com/users/tonycoz/followers","following_url":"https://api.github.com/users/tonycoz/following{/other_user}","gists_url":"https://api.github.com/users/tonycoz/gists{/gist_id}","starred_url":"https://api.github.com/users/tonycoz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tonycoz/subscriptions","organizations_url":"https://api.github.com/users/tonycoz/orgs","repos_url":"https://api.github.com/users/tonycoz/repos","events_url":"https://api.github.com/users/tonycoz/events{/privacy}","received_events_url":"https://api.github.com/users/tonycoz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-07-28T04:18:51Z","updated_at":"2016-08-01T04:52:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/pulls/53","html_url":"https://github.com/Perl-Toolchain-Gang/Test-Harness/pull/53","diff_url":"https://github.com/Perl-Toolchain-Gang/Test-Harness/pull/53.diff","patch_url":"https://github.com/Perl-Toolchain-Gang/Test-Harness/pull/53.patch"},"body":"App::Prove (and hence prove) attempts to load plugins under both\r\nthe App::Prove::Plugin namespace and under the base namespace.\r\n\r\nIf a plugin is only available under the base namespace, and a user runs\r\nprove from a world-writable directory such as /tmp, an attacker can\r\nApp/Prove/Plugin/PluginName.pm to run code as the user running prove."},"comment":{"url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/comments/236489091","html_url":"https://github.com/Perl-Toolchain-Gang/Test-Harness/pull/53#issuecomment-236489091","issue_url":"https://api.github.com/repos/Perl-Toolchain-Gang/Test-Harness/issues/53","id":236489091,"user":{"login":"einhverfr","id":341143,"avatar_url":"https://avatars.githubusercontent.com/u/341143?v=3","gravatar_id":"","url":"https://api.github.com/users/einhverfr","html_url":"https://github.com/einhverfr","followers_url":"https://api.github.com/users/einhverfr/followers","following_url":"https://api.github.com/users/einhverfr/following{/other_user}","gists_url":"https://api.github.com/users/einhverfr/gists{/gist_id}","starred_url":"https://api.github.com/users/einhverfr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/einhverfr/subscriptions","organizations_url":"https://api.github.com/users/einhverfr/orgs","repos_url":"https://api.github.com/users/einhverfr/repos","events_url":"https://api.github.com/users/einhverfr/events{/privacy}","received_events_url":"https://api.github.com/users/einhverfr/received_events","type":"User","site_admin":false},"created_at":"2016-08-01T04:52:11Z","updated_at":"2016-08-01T04:52:11Z","body":"@ehuelsmann I think it is ok for programs to decide whether they want to allow inclusion from '.'  I don't think it is ok for libraries to do so.  But I agree it would be better to have a pragma that excludes world-readable directories from inclusion.\r\n\r\nBut again, this fix in no way renders prove immune to this sort of attack unless the application being tested is also immune (using `no lib '.'`) \r\n\r\n@ap the problem here is that you have a proliferation of reasons why '.' may be included or may not, and that strikes me as a bad approach.  Debian introduced a serious bug in their effort to fix  this (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833030) and the concern I have is that the cause of the bug and the safety of the patch in that case were not subject to a degree of obviousness conducive to robust security changes.   Sprinkling this logic everywhere is *really bad practice* for the reason shown in the bug report I filed with Debian."}}
{"actor":{"display_login":"einhverfr"}}