/ 
ack-v3.10.0
⭐ Starred 726 / App::Ack::Filter
Security Advisories (2)
CVE-2026-49145 (2026-07-08)

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

CVE-2026-49147 (2026-07-08)

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.

NAME

App::Ack::Filter - Filter objects to filter files

DESCRIPTION

An abstract superclass that represents objects that can filter App::Ack::File objects. App::Ack::Filter implementations are responsible for filtering filenames to be searched.

SYNOPSIS

# filter implementation
package MyFilter;

use strict;
use warnings;
use parent 'App::Ack::Filter';

sub filter {
    my ( $self, $file ) = @_;
}

BEGIN {
    App::Ack::Filter->register_filter('mine' => __PACKAGE__);
}

1;

# users
App::Ack::Filter->create_filter('mine', @args);

METHODS

App::Ack::Filter->create_filter($type, @args)

Creates a filter implementation, registered as $type. @args are provided as additional arguments to the implementation's constructor.

App::Ack::Filter->register_filter($type, $package)

Registers a filter implementation package $package under the name $type.

$filter->filter( $file )

Must be implemented by filter implementations. Returns true if the filter passes, false otherwise. This method must not alter the passed-in $file object.

$filter->invert()

Returns a filter whose "filter" method returns the opposite of this filter.

$filter->is_inverted()

Returns true if this filter is an inverted filter; false otherwise.

$filter->to_string

Converts the filter to a string. This method is also called implicitly by stringification.

$filter->inspect

Prints a human-readable debugging string for this filter. Useful for, you guessed it, debugging.