/ 
ack-2.00b03
⭐ Starred 726 / App::Ack
Security Advisories (3)
CVE-2026-49145 (2026-07-08)

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

CVE-2026-49146 (2026-07-08)

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.

CVE-2026-49147 (2026-07-08)

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename. A file whose name embeds cursor-movement or color escapes can overwrite or recolor earlier terminal output, or be passed unchanged to a downstream consumer.

NAME

App::Ack - A container for functions for the ack program

VERSION

Version 2.00b03

SYNOPSIS

If you want to know about the ack program, see the ack file itself.

No user-serviceable parts inside. ack is all that should use this.

FUNCTIONS

read_ackrc

Reads the contents of the .ackrc file and returns the arguments.

create_ignore_rules( $what, $where, \@opts )

Takes an array of options passed in on the command line and returns a hashref of information about them:

* # is: Match the filename exactly # ext: Match the extension # regex: Match against a Perl regular expression

remove_dir_sep( $path )

This functions removes a trailing path separator, if there is one, from its argument

build_regex( $str, \%opts )

Returns a regex object based on a string and command-line options.

Dies when the regex $str is undefinied (i.e. not given on command line).

check_regex( $regex_str )

Checks that the $regex_str can be compiled into a perl regular expression. Dies with the error message if this is not the case.

No return value.

warn( @_ )

Put out an ack-specific warning.

die( @_ )

Die in an ack-specific way.

filetypes_supported()

Returns a list of all the types that we can detect.

show_help()

Dumps the help page to the user.

show_help_types()

Display the filetypes help subpage.

get_version_statement

Returns the version information for ack.

Prints the version information for ack.

Return the copyright for ack.

load_colors

Set default colors, load Term::ANSIColor

output_to_pipe()

Returns true if ack's input is coming from a pipe.

exit_from_ack

Exit from the application with the correct exit code.

Returns with 0 if a match was found, otherwise with 1. The number of matches is handed in as the only argument.

COPYRIGHT & LICENSE

Copyright 2005-2012 Andy Lester.

This program is free software; you can redistribute it and/or modify it under the terms of the Artistic License v2.0.