/ 
perl-5.19.7
⭐ Starred 2013
/ Locale::Maketext::Cookbook
Security Advisories (18)
CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2018-6797 (2018-04-17)

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2017-12837 (2017-09-19)

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

NAME

Locale::Maketext::Cookbook - recipes for using Locale::Maketext

INTRODUCTION

This is a work in progress. Not much progress by now :-)

ONESIDED LEXICONS

Adapted from a suggestion by Dan Muey

It may be common (for example at your main lexicon) that the hash keys and values coincide. Like that

q{Hello, tell me your name} 
  => q{Hello, tell me your name}

It would be nice to just write:

q{Hello, tell me your name} => ''

and have this magically inflated to the first form. Among the advantages of such representation, that would lead to smaller files, less prone to mistyping or mispasting, and handy to someone translating it which can simply copy the main lexicon and enter the translation instead of having to remove the value first.

That can be achieved by overriding init in your class and working on the main lexicon with code like that:

package My::I18N;
...

sub init {
    my $lh = shift; # a newborn handle
    $lh->SUPER::init();
    inflate_lexicon(\%My::I18N::en::Lexicon);
    return;
}

sub inflate_lexicon {
    my $lex = shift;
    while (my ($k, $v) = each %$lex) {
        $v = $k if !defined $v || $v eq '';
    }
}

Here we are assuming My::I18N::en to own the main lexicon.

There are some downsides here: the size economy will not stand at runtime after this init() runs. But it should not be that critical, since if you don't have space for that, you won't have space for any other language besides the main one as well. You could do that too with ties, expanding the value at lookup time which should be more time expensive as an option.

DECIMAL PLACES IN NUMBER FORMATTING

After CPAN RT #36136 (https://rt.cpan.org/Ticket/Display.html?id=36136)

The documentation of Locale::Maketext advises that the standard bracket method numf is limited and that you must override that for better results. It even suggests the use of Number::Format.

One such defect of standard numf is to not be able to use a certain decimal precision. For example,

$lh->maketext('pi is [numf,_1]', 355/113);

outputs

pi is 3.14159292035398

Since pi ≈ 355/116 is only accurate to 6 decimal places, you would want to say:

$lh->maketext('pi is [numf,_1,6]', 355/113);

and get "pi is 3.141592".

One solution for that could use Number::Format like that:

package Wuu;

use base qw(Locale::Maketext);

use Number::Format;

# can be overridden according to language conventions
sub _numf_params {
    return (
        -thousands_sep  => '.',
        -decimal_point  => ',',
        -decimal_digits => 2,
    );
}

# builds a Number::Format
sub _numf_formatter {
    my ($lh, $scale) = @_;
    my @params = $lh->_numf_params;
    if ($scale) { # use explicit scale rather than default
        push @params, (-decimal_digits => $scale);
    }
    return Number::Format->new(@params);
}

sub numf {
    my ($lh, $n, $scale) = @_;
    # get the (cached) formatter
    my $nf = $lh->{__nf}{$scale} ||= $lh->_numf_formatter($scale);
    # format the number itself
    return $nf->format_number($n);
}

package Wuu::pt;

use base qw(Wuu);

and then

my $lh = Wuu->get_handle('pt');
$lh->maketext('A [numf,_1,3] km de distância', 1550.2222);

would return "A 1.550,222 km de distância".

Notice that the standard utility methods of Locale::Maketext are irremediably limited because they could not aim to do everything that could be expected from them in different languages, cultures and applications. So extending numf, quant, and sprintf is natural as soon as your needs exceed what the standard ones do.