/ 
libwww-perl-5.830
⭐ Starred 204
/ lwp-download
Security Advisories (3)
CVE-2010-2253 (2010-07-06)

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

CVE-2011-0633 (2011-01-20)

The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated.

CPANSA-libwww-perl-2017-01 (2017-11-06)

LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command

NAME

lwp-download - Fetch large files from the web

SYNOPSIS

lwp-download [-a] <url> [<local path>]

DESCRIPTION

The lwp-download program will save the file at url to a local file.

If local path is not specified, then the current directory is assumed.

If local path is a directory, then the basename of the file to save is picked up from the Content-Disposition header or the URL of the response. If the file already exists, then lwp-download will prompt before it overwrites and will fail if its standard input is not a terminal. This form of invocation will also fail is no acceptable filename can be derived from the sources mentioned above.

If local path is not a directory, then it is simply used as the path to save into.

The lwp-download program is implemented using the libwww-perl library. It is better suited to down load big files than the lwp-request program because it does not store the file in memory. Another benefit is that it will keep you updated about its progress and that you don't have much options to worry about.

Use the -a option to save the file in text (ascii) mode. Might make a difference on dosish systems.

EXAMPLE

Fetch the newest and greatest perl version:

$ lwp-download http://www.perl.com/CPAN/src/latest.tar.gz
Saving to 'latest.tar.gz'...
11.4 MB received in 8 seconds (1.43 MB/sec)

AUTHOR

Gisle Aas <gisle@aas.no>