Skip to content

Commit

Permalink
Disable unicode_strings when working with regular expressions
Browse files Browse the repository at this point in the history
Mojo::Base 0.50 enables unicode_strings feature in the scope where it
used from. As a result, deserializing a regular expression injects
qr//u flag to regexp object although the was no such flags in the
deserialized BSON. The same issue repeats in t/bson.t when shuffling
with the regular expressions.

The consequence is that a t/bson.t test fails.

This patch fixes it with disabling unicode_strings feature where
needed.

oliwer#36
  • Loading branch information
ppisar committed Jun 4, 2020
1 parent 260788c commit 817c787
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 0 deletions.
3 changes: 3 additions & 0 deletions lib/Mango/BSON.pm
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,9 @@ sub _decode_value {
my ($p, $m) = (_decode_cstring($bsonref), _decode_cstring($bsonref));
croak "invalid regex modifier(s) in 'qr/$p/$m'"
if length($m) and $m !~ /^[msixpadlun]+\z/;
# prevent from injecting qr//u modifier implied by a feature enabled by
# Mojolicious 8.50
no feature 'unicode_strings';
# escape $pat to avoid code injection
return eval "qr/\$p/$m";
}
Expand Down
3 changes: 3 additions & 0 deletions t/bson.t
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,9 @@ sub TO_BSON { {something => shift->something} }

package main;
use Mojo::Base -strict;
# prevent from injecting qr//u modifier implied by a feature enabled by
# Mojolicious 8.50
no feature 'unicode_strings';
no warnings 'portable'; # Mango works on 64bits systems only

use Test::More;
Expand Down

0 comments on commit 817c787

Please sign in to comment.