微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦!

Perl的安全性是否了解新功能?

我正在使用 Safe模块,以包含在 Mastering Perl. v5.16之前的版本(最早支持的版本)似乎不了解新的关键字.我错过了什么吗?

说使用v5.16和更高版本

use v5.10;

use Safe;

say "Running $0 under $^V with Safe ",Safe->VERSION;

my $compartment = Safe->new;
$compartment->permit( ':base_io',':load' );

my $code =<<"CODE";
use v5.10;
say "Hello Safe!";
CODE

$compartment->reval( $code ) or do {
        my $error = $@;
        warn "Safe compartment error! $@";
        };

这个代码按照我在v5.18和v5.16中的预期运行,两个officially supported versions of Perl

% perl5.18.0 safe.pl
Running safe.pl under v5.18.0 with Safe 2.35
Hello Safe!

% perl5.16.3 safe.pl
Running safe.pl under v5.16.3 with Safe 2.35
Hello Safe!

它在v5.16之前不起作用,因为它不认为say关键字是有效的:

% perl5.14.4 safe.pl
Running safe.pl under v5.14.4 with Safe 2.35
String found where operator expected at (eval 5) line 2,near "say "Hello Safe!""
    (Do you need to predeclare say?)
Safe compartment error! Syntax error at (eval 5) line 2,near "say "Hello Safe!""

% perl5.12.3 safe.pl
Running safe.pl under v5.12.3 with Safe 2.35
String found where operator expected at (eval 5) line 2,near "say "Hello Safe!""

% perl5.10.1 safe.pl
Running safe.pl under v5.10.1 with Safe 2.35
String found where operator expected at (eval 5) line 2,near "say "Hello Safe!""

状态不起作用,但是有所不同

state是不同的.

use v5.10;

use Safe;

say "Running $0 under $^V with Safe ",':load' );

my $code =<<'CODE';
use v5.10;
print "Hello Safe!\n";
foo();
sub foo {
    state $n = 0;
    print "n is $n\n";
    }
CODE

$compartment->reval( $code ) or do {
        my $error = $@;
        warn "Safe compartment error! $@";
        };

v5.18和v5.16认为state一个语法错误

% perl5.18.0 safe.pl
Running safe.pl under v5.18.0 with Safe 2.35
Hello Safe!
n is 0

% perl5.16.3 safe.pl
Running safe.pl under v5.16.3 with Safe 2.35
Hello Safe!
n is 0

在这些版本之前,我认为将状态视为间接方法

% perl5.14.4 safe.pl
Running safe.pl under v5.14.4 with Safe 2.35
Hello Safe!
Safe compartment error! Can't call method "state" on an undefined value at (eval 5) line 5.

特定

给出了同样的问题:

use v5.10;

use Safe;

say "Running $0 under $^V with Safe ",':load' );

my $code =<<'CODE';
use v5.10;
print "Hello Safe!\n";
my $foo = 'Buster Bean';
given( $foo ) {
    when( /Buster/ ) { print "Buster\n" }
    }
CODE

$compartment->reval( $code ) or do {
        my $error = $@;
        warn "Safe compartment error! $@";
        };

它在v5.16和v5.18中工作正常:

% perl5.18.0 safe.pl
Running safe.pl under v5.18.0 with Safe 2.35
given is experimental at (eval 5) line 4.
when is experimental at (eval 5) line 5.
Hello Safe!
Buster

但早期版本中断:

% perl5.14.4 safe.pl
Running safe.pl under v5.14.4 with Safe 2.35
Safe compartment error! Syntax error at (eval 5) line 4,near ") {"

解决方法

可以使用平分工具来检查某段代码何时开始工作.包括一个,如果您克隆整个Perl存储库.这允许检查何时开始工作.
~/perl> Porting/bisect.pl --expect-fail --start=v5.14.0 --end=v5.16.3 -e '
        use v5.10;

        use Safe;

        say "Running $0 under $^V with Safe ",Safe->VERSION;

        my $compartment = Safe->new;
        $compartment->permit( ":base_io",":load" );

        my $code =<<"CODE";
        use v5.10;
        say "Hello Safe!";
        CODE

        $compartment->reval( $code ) or do {
                my $error = $@;
                warn "Safe compartment error! $@";
                exit 1;
                };
        '

做完之后,你会得到结果.

7d69d4a61be1619f90910462eac42234c874712e is the first bad commit
commit 7d69d4a61be1619f90910462eac42234c874712e
Author: Father Chrysostomos <sprout@cpan.org>
Date:   Thu Dec 15 16:26:16 2011 -0800

    disable $[ under 5.16

    This adds the array_base feature to feature.pm

    Perl_feature_is_enabled has been modified to use PL_curcop,rather
    than PL_hintgv,so it can work with run-time hints as well.
    (PL_curcop holds the current state op at run time,and &PL_compiling
    at compile time,so it works for both.)  The hints in $^H are not
    stored in the same place at compile time and run time,so the FEATURE_IS_ENABLED macro has been modified to check first whether
    PL_curop == &PL_compiling.

    Since array_base is on by default with no hint for it in %^H,it is
    a ‘negative’ feature,whose entry in %^H turns it off.  feature.pm
    has been modified to support such negative features.  The new FEATURE_IS_ENABLED_d can check whether such default features
    are enabled.

    This does make things less efficient,as every version declaration
    Now loads feature.pm to disable all features (including turning off
    array_base,which entails adding an entry to %^H) before loading the
    new bundle.  I have plans to make this more efficient.

:100644 100644 e96e6608641a33838158a54cb0ac2402c716e848 3b81d3fc286480be3512864b43f3c9230fd1c376 M      embed.fnc
:040000 040000 7f9483dd9d2f290810866ad40810461398385515 e1d43bd8aa24bec1d6b5f80a1f36f6787fb70d32 M      ext
:100644 100644 2af41a87c417a2afded5c9f55bd0a69bcf71db80 37a1bd9510eb5064d052fb00b68a0e7eec3df716 M      gv.c
:040000 040000 9d82bf63a49734aec1e01c5da6362c3dec7e1a22 2b12bd8c206ae14fc819fbb781cdb2b09c1a9c95 M      lib
:100644 100644 c55ca63a5819c32c747279ddcc698653dc8eca6f 3432dfe5c4c7b568712a9f0f31177695528892e4 M      mg.c
:100644 100644 313087d34a4135e1854b4f00ab58b71d687a32e1 812ece2bb1757489865e36dec0ceeaa8d6c86168 M      op.c
:100644 100644 e203dfe1941e7c3e13cdf6b68e509339258229bf ef3d4efec6604738d6beded3ff16d9a1ab73c465 M      perl.h
:100644 100644 92befdac8afebe578740e84ca24ca46a091b072e eec052f413638d1efba00c81f423a68d1a4f984e M      proto.h
:040000 040000 9deb7ece55f230bcf0e0bb83a5e1646e05770db2 d425283f05fb825181a2b3836ff3ce2570821500 M      t
:100644 100644 2c29c582e2a1c2ba6aeefe56368a383785b27830 2f395d458da5941b49552d85bbf52b1070b5b32e M      toke.c
bisect run success
That took 1921 seconds

问题是这是一个意外修复的bug.如果您看看diff for toke.c,您可以注意到旧版本采用PL_hintgv的功能,但新版本使用PL_curcop.这些之间的区别是PL_hintgv包含编译时间单位设置.但是PL_curcop包含当前设置.在安全的情况下,将功能保存到错误的位置.

问题是PL_hintgv检查当前编译单元.在处理Safe时,它是无意义的空哈希,因为黑客模块做的工作. PL_curcop检查当前范围 – 因此它与Safe保持一致.

现在解决办法一个存在,但它涉及使用eval指定设置.作为eval设置编译单元,您可以使用它来指定所需的设置.它不会让用户更改设置,但会为您提供评估代码的一些设置.

例如,如果您在代码中使用eval’$compartment-> reval($code)’更改$compartment-> reval($code),它将开始工作,因为eval创建了一个新的编译单元,并且您的代码使用v5.10;在标题(eval副本使用v5.10从它).然而,这是可怕的黑客…

版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。

相关推荐