Security Advisories (1)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

NAME

Test2::Compare::Base - Base class for comparison classes.

DESCRIPTION

All comparison classes for Test2::Compare should inherit from this base class.

SYNOPSIS

package Test2::Compare::MyCheck;
use strict;
use warnings;

use base 'Test2::Compare::Base';
use Test2::Util::HashBase qw/stuff/;

sub name { 'STUFF' }

sub operator {
    my $self = shift;
    my ($got) = @_;
    return 'eq';
}

sub verify {
    my $self = shift;
    my $params = @_;

    # Always check if $got exists! This method must return false if no
    # value at all was received.
    return 0 unless $params{exists};

    my $got = $params{got};

    # Returns true if both values match. This includes undef, 0, and other
    # false-y values!
    return $got eq $self->stuff;
}

METHODS

Some of these must be overridden, others can be.

$dclass = $check->delta_class

Returns the delta subclass that should be used. By default Test2::Compare::Delta is used.

@deltas = $check->deltas(id => $id, exists => $bool, got => $got, convert => \&convert, seen => \%seen)

Should return child deltas.

@lines = $check->got_lines($got)

This is your chance to provide line numbers for errors in the $got structure.

$op = $check->operator()
$op = $check->operator($got)

Returns the operator that was used to compare the check with the received data in $got. If there was no value for got then there will be no arguments, undef will only be an argument if undef was seen in $got. This is how you can tell the difference between a missing value and an undefined one.

$bool = $check->verify(id => $id, exists => $bool, got => $got, convert => \&convert, seen => \%seen)

Return true if there is a shallow match, that is both items are arrayrefs, both items are the same string or same number, etc. This should not recurse, as deep checks are done in $check->deltas().

$name = $check->name

Get the name of the check.

$display = $check->render

What should be displayed in a table for this check, usually the name or value.

$delta = $check->run(id => $id, exists => $bool, got => $got, convert => \&convert, seen => \%seen)

This is where the checking is done, first a shallow check using $check->verify, then checking $check->deltas(). \%seen is used to prevent cycles.

SOURCE

The source code repository for Test2-Suite can be found at https://github.com/Test-More/test-more/.

MAINTAINERS

Chad Granum <exodist@cpan.org>

AUTHORS

Chad Granum <exodist@cpan.org>

COPYRIGHT

Copyright Chad Granum <exodist@cpan.org>.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://dev.perl.org/licenses/