Security Advisories (22)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2011-0761 (2011-05-13)

Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

NAME

TAP::Harness - Run test scripts with statistics

VERSION

Version 3.17

DESCRIPTION

This is a simple test harness which allows tests to be run and results automatically aggregated and output to STDOUT.

SYNOPSIS

use TAP::Harness;
my $harness = TAP::Harness->new( \%args );
$harness->runtests(@tests);

METHODS

Class Methods

new

my %args = (
   verbosity => 1,
   lib     => [ 'lib', 'blib/lib', 'blib/arch' ],
)
my $harness = TAP::Harness->new( \%args );

The constructor returns a new TAP::Harness object. It accepts an optional hashref whose allowed keys are:

  • verbosity

    Set the verbosity level:

     1   verbose        Print individual test results to STDOUT.
     0   normal
    -1   quiet          Suppress some test output (mostly failures 
                        while tests are running).
    -2   really quiet   Suppress everything but the tests summary.
    -3   silent         Suppress everything.
  • timer

    Append run time for each test to output. Uses Time::HiRes if available.

  • failures

    Show test failures (this is a no-op if verbose is selected).

  • comments

    Show test comments (this is a no-op if verbose is selected).

  • show_count

    Update the running test count during testing.

  • normalize

    Set to a true value to normalize the TAP that is emitted in verbose modes.

  • lib

    Accepts a scalar value or array ref of scalar values indicating which paths to allowed libraries should be included if Perl tests are executed. Naturally, this only makes sense in the context of tests written in Perl.

  • switches

    Accepts a scalar value or array ref of scalar values indicating which switches should be included if Perl tests are executed. Naturally, this only makes sense in the context of tests written in Perl.

  • test_args

    A reference to an @INC style array of arguments to be passed to each test program.

  • color

    Attempt to produce color output.

  • exec

    Typically, Perl tests are run through this. However, anything which spits out TAP is fine. You can use this argument to specify the name of the program (and optional switches) to run your tests with:

    exec => ['/usr/bin/ruby', '-w']

    You can also pass a subroutine reference in order to determine and return the proper program to run based on a given test script. The subroutine reference should expect the TAP::Harness object itself as the first argument, and the file name as the second argument. It should return an array reference containing the command to be run and including the test file name. It can also simply return undef, in which case TAP::Harness will fall back on executing the test script in Perl:

    exec => sub {
        my ( $harness, $test_file ) = @_;
    
        # Let Perl tests run.
        return undef if $test_file =~ /[.]t$/;
        return [ qw( /usr/bin/ruby -w ), $test_file ]
          if $test_file =~ /[.]rb$/;
      }

    If the subroutine returns a scalar with a newline or a filehandle, it will be interpreted as raw TAP or as a TAP stream, respectively.

  • merge

    If merge is true the harness will create parsers that merge STDOUT and STDERR together for any processes they start.

  • aggregator_class

    The name of the class to use to aggregate test results. The default is TAP::Parser::Aggregator.

  • formatter_class

    The name of the class to use to format output. The default is TAP::Formatter::Console, or TAP::Formatter::File if the output isn't a TTY.

  • multiplexer_class

    The name of the class to use to multiplex tests during parallel testing. The default is TAP::Parser::Multiplexer.

  • parser_class

    The name of the class to use to parse TAP. The default is TAP::Parser.

  • scheduler_class

    The name of the class to use to schedule test execution. The default is TAP::Parser::Scheduler.

  • formatter

    If set formatter must be an object that is capable of formatting the TAP output. See TAP::Formatter::Console for an example.

  • errors

    If parse errors are found in the TAP output, a note of this will be made in the summary report. To see all of the parse errors, set this argument to true:

    errors => 1
  • directives

    If set to a true value, only test results with directives will be displayed. This overrides other settings such as verbose or failures.

  • ignore_exit

    If set to a true value instruct TAP::Parser to ignore exit and wait status from test scripts.

  • jobs

    The maximum number of parallel tests to run at any time. Which tests can be run in parallel is controlled by rules. The default is to run only one test at a time.

  • rules

    A reference to a hash of rules that control which tests may be executed in parallel. This is an experimental feature and the interface may change.

    $harness->rules(
        {   par => [
                { seq => '../ext/DB_File/t/*' },
                { seq => '../ext/IO_Compress_Zlib/t/*' },
                { seq => '../lib/CPANPLUS/*' },
                { seq => '../lib/ExtUtils/t/*' },
                '*'
            ]
        }
    );
  • stdout

    A filehandle for catching standard output.

Any keys for which the value is undef will be ignored.

Instance Methods

runtests

$harness->runtests(@tests);

Accepts and array of @tests to be run. This should generally be the names of test files, but this is not required. Each element in @tests will be passed to TAP::Parser::new() as a source. See TAP::Parser for more information.

It is possible to provide aliases that will be displayed in place of the test name by supplying the test as a reference to an array containing [ $test, $alias ]:

$harness->runtests( [ 't/foo.t', 'Foo Once' ],
                    [ 't/foo.t', 'Foo Twice' ] );

Normally it is an error to attempt to run the same test twice. Aliases allow you to overcome this limitation by giving each run of the test a unique name.

Tests will be run in the order found.

If the environment variable PERL_TEST_HARNESS_DUMP_TAP is defined it should name a directory into which a copy of the raw TAP for each test will be written. TAP is written to files named for each test. Subdirectories will be created as needed.

Returns a TAP::Parser::Aggregator containing the test results.

summary

Output the summary for a TAP::Parser::Aggregator.

aggregate_tests

$harness->aggregate_tests( $aggregate, @tests );

Run the named tests and display a summary of result. Tests will be run in the order found.

Test results will be added to the supplied TAP::Parser::Aggregator. aggregate_tests may be called multiple times to run several sets of tests. Multiple Test::Harness instances may be used to pass results to a single aggregator so that different parts of a complex test suite may be run using different TAP::Harness settings. This is useful, for example, in the case where some tests should run in parallel but others are unsuitable for parallel execution.

my $formatter   = TAP::Formatter::Console->new;
my $ser_harness = TAP::Harness->new( { formatter => $formatter } );
my $par_harness = TAP::Harness->new(
    {   formatter => $formatter,
        jobs      => 9
    }
);
my $aggregator = TAP::Parser::Aggregator->new;

$aggregator->start();
$ser_harness->aggregate_tests( $aggregator, @ser_tests );
$par_harness->aggregate_tests( $aggregator, @par_tests );
$aggregator->stop();
$formatter->summary($aggregator);

Note that for simpler testing requirements it will often be possible to replace the above code with a single call to runtests.

Each elements of the @tests array is either

  • the file name of a test script to run

  • a reference to a [ file name, display name ] array

When you supply a separate display name it becomes possible to run a test more than once; the display name is effectively the alias by which the test is known inside the harness. The harness doesn't care if it runs the same script more than once when each invocation uses a different name.

make_scheduler

Called by the harness when it needs to create a TAP::Parser::Scheduler. Override in a subclass to provide an alternative scheduler. make_scheduler is passed the list of tests that was passed to aggregate_tests.

jobs

Gets or sets the number of concurrent test runs the harness is handling. By default, this value is 1 -- for parallel testing, this should be set higher.

SUBCLASSING

TAP::Harness is designed to be (mostly) easy to subclass. If you don't like how a particular feature functions, just override the desired methods.

Methods

TODO: This is out of date

The following methods are ones you may wish to override if you want to subclass TAP::Harness.

summary

$harness->summary( \%args );

summary prints the summary report after all tests are run. The argument is a hashref with the following keys:

  • start

    This is created with Benchmark->new and it the time the tests started. You can print a useful summary time, if desired, with:

    $self->output(
        timestr( timediff( Benchmark->new, $start_time ), 'nop' ) );
  • tests

    This is an array reference of all test names. To get the TAP::Parser object for individual tests:

    my $aggregate = $args->{aggregate};
    my $tests     = $args->{tests};
    
    for my $name ( @$tests ) {
        my ($parser) = $aggregate->parsers($test);
        ... do something with $parser
    }

    This is a bit clunky and will be cleaned up in a later release.

make_parser

Make a new parser and display formatter session. Typically used and/or overridden in subclasses.

my ( $parser, $session ) = $harness->make_parser;

finish_parser

Terminate use of a parser. Typically used and/or overridden in subclasses. The parser isn't destroyed as a result of this.

REPLACING

If you like the prove utility and TAP::Parser but you want your own harness, all you need to do is write one and provide new and runtests methods. Then you can use the prove utility like so:

prove --harness My::Test::Harness

Note that while prove accepts a list of tests (or things to be tested), new has a fairly rich set of arguments. You'll probably want to read over this code carefully to see how all of them are being used.

SEE ALSO

Test::Harness