Security Advisories (1)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

NAME

Test2::Util::Grabber - Object used to temporarily intercept all events.

DESCRIPTION

Once created this object will intercept and stash all events sent to the shared Test2::Hub object. Once the object is destroyed, events will once again be sent to the shared hub.

SYNOPSIS

use Test2 qw/Core Grab/;

my $grab = grab();

# Generate some events, they are intercepted.
ok(1, "pass");
ok(0, "fail");

my $events_a = $grab->flush;

# Generate some more events, they are intercepted.
ok(1, "pass");
ok(0, "fail");

# Same as flush, except it destroys the grab object.
my $events_b = $grab->finish;

After calling finish() the grab object is destroyed and $grab is set to undef. $events_a is an arrayref with the first two events. $events_b is an arrayref with the second two events.

EXPORTS

$grab = grab()

This lets you intercept all events for a section of code without adding anything to your call stack. This is useful for things that are sensitive to changes in the stack depth.

my $grab = grab();
    ok(1, 'foo');
    ok(0, 'bar');

# $grab is magically undef after this.
my $events = $grab->finish;

is(@$events, 2, "grabbed two events.");

When you call finish() the $grab object will automagically undef itself, but only for the reference used in the method call. If you have other references to the $grab object they will not be set to undef.

If the $grab object is destroyed without calling finish(), it will automatically clean up after itself and restore the parent hub.

{
    my $grab = grab();
    # Things are grabbed
}
# Things are back to normal

By default the hub used has no_ending set to true. This will prevent the hub from enforcing that you issued a plan and ran at least one test. You can turn enforcement back one like this:

$grab->hub->set_no_ending(0);

With no_ending turned off, finish will run the post-test checks to enforce the plan and that tests were run. In many cases this will result in additional events in your events array.

METHODS

$grab = $class->new()

Create a new grab object, immediately starts intercepting events.

$ar = $grab->flush()

Get an arrayref of all the events so far, clearing the grab objects internal list.

$ar = $grab->events()

Get an arrayref of all events so far. Does not clear the internal list.

$ar = $grab->finish()

Get an arrayref of all the events, then destroy the grab object.

$hub = $grab->hub()

Get the hub that is used by the grab event.

ENDING BEHAVIOR

By default the hub used has no_ending set to true. This will prevent the hub from enforcing that you issued a plan and ran at least one test. You can turn enforcement back one like this:

$grab->hub->set_no_ending(0);

With no_ending turned off, finish will run the post-test checks to enforce the plan and that tests were run. In many cases this will result in additional events in your events array.

SEE ALSO

Test2::Tools::Intercept - Accomplish the same thing, but using blocks instead.

SOURCE

The source code repository for Test2 can be found at https://github.com/Test-More/test-more/.

MAINTAINERS

Chad Granum <exodist@cpan.org>

AUTHORS

Chad Granum <exodist@cpan.org>

COPYRIGHT

Copyright Chad Granum <exodist@cpan.org>.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://dev.perl.org/licenses/