Security Advisories (21)
CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2017-12814 (2017-09-28)

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2018-6798 (2018-04-17)

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.

CVE-2017-12883 (2017-09-19)

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6797 (2018-04-17)

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.

CVE-2017-12837 (2017-09-19)

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

NAME

prove - Run tests through a TAP harness.

USAGE

prove [options] [files or directories]

OPTIONS

Boolean options:

-v,  --verbose         Print all test lines.
-l,  --lib             Add 'lib' to the path for your tests (-Ilib).
-b,  --blib            Add 'blib/lib' and 'blib/arch' to the path for
                       your tests
-s,  --shuffle         Run the tests in random order.
-c,  --color           Colored test output (default).
     --nocolor         Do not color test output.
     --count           Show the X/Y test count when not verbose
                       (default)
     --nocount         Disable the X/Y test count.
-D   --dry             Dry run. Show test that would have run.
-f,  --failures        Show failed tests.
-o,  --comments        Show comments.
     --ignore-exit     Ignore exit status from test scripts.
-m,  --merge           Merge test scripts' STDERR with their STDOUT.
-r,  --recurse         Recursively descend into directories.
     --reverse         Run the tests in reverse order.
-q,  --quiet           Suppress some test output while running tests.
-Q,  --QUIET           Only print summary results.
-p,  --parse           Show full list of TAP parse errors, if any.
     --directives      Only show results with TODO or SKIP directives.
     --timer           Print elapsed time after each test.
     --trap            Trap Ctrl-C and print summary on interrupt.
     --normalize       Normalize TAP output in verbose output
-T                     Enable tainting checks.
-t                     Enable tainting warnings.
-W                     Enable fatal warnings.
-w                     Enable warnings.
-h,  --help            Display this help
-?,                    Display this help
-V,  --version         Display the version
-H,  --man             Longer manpage for prove
     --norc            Don't process default .proverc

Options that take arguments:

-I                     Library paths to include.
-P                     Load plugin (searches App::Prove::Plugin::*.)
-M                     Load a module.
-e,  --exec            Interpreter to run the tests ('' for compiled
                       tests.)
     --ext             Set the extension for tests (default '.t')
     --harness         Define test harness to use.  See TAP::Harness.
     --formatter       Result formatter to use. See FORMATTERS.
     --source          Load and/or configure a SourceHandler. See
                       SOURCE HANDLERS.
-a,  --archive out.tgz Store the resulting TAP in an archive file.
-j,  --jobs N          Run N test jobs in parallel (try 9.)
     --state=opts      Control prove's persistent state.
     --rc=rcfile       Process options from rcfile
     --rules           Rules for parallel vs sequential processing.

NOTES

.proverc

If ~/.proverc or ./.proverc exist they will be read and any options they contain processed before the command line options. Options in .proverc are specified in the same way as command line options:

# .proverc
--state=hot,fast,save
-j9

Additional option files may be specified with the --rc option. Default option file processing is disabled by the --norc option.

Under Windows and VMS the option file is named _proverc rather than .proverc and is sought only in the current directory.

Reading from STDIN

If you have a list of tests (or URLs, or anything else you want to test) in a file, you can add them to your tests by using a '-':

prove - < my_list_of_things_to_test.txt

See the README in the examples directory of this distribution.

Default Test Directory

If no files or directories are supplied, prove looks for all files matching the pattern t/*.t.

Colored Test Output

Colored test output using TAP::Formatter::Color is the default, but if output is not to a terminal, color is disabled. You can override this by adding the --color switch.

Color support requires Term::ANSIColor on Unix-like platforms and Win32::Console on windows. If the necessary module is not installed colored output will not be available.

Exit Code

If the tests fail prove will exit with non-zero status.

Arguments to Tests

It is possible to supply arguments to tests. To do so separate them from prove's own arguments with the arisdottle, '::'. For example

prove -v t/mytest.t :: --url http://example.com

would run t/mytest.t with the options '--url http://example.com'. When running multiple tests they will each receive the same arguments.

--exec

Normally you can just pass a list of Perl tests and the harness will know how to execute them. However, if your tests are not written in Perl or if you want all tests invoked exactly the same way, use the -e, or --exec switch:

prove --exec '/usr/bin/ruby -w' t/
prove --exec '/usr/bin/perl -Tw -mstrict -Ilib' t/
prove --exec '/path/to/my/customer/exec'

--merge

If you need to make sure your diagnostics are displayed in the correct order relative to test results you can use the --merge option to merge the test scripts' STDERR into their STDOUT.

This guarantees that STDOUT (where the test results appear) and STDERR (where the diagnostics appear) will stay in sync. The harness will display any diagnostics your tests emit on STDERR.

Caveat: this is a bit of a kludge. In particular note that if anything that appears on STDERR looks like a test result the test harness will get confused. Use this option only if you understand the consequences and can live with the risk.

--trap

The --trap option will attempt to trap SIGINT (Ctrl-C) during a test run and display the test summary even if the run is interrupted

--state

You can ask prove to remember the state of previous test runs and select and/or order the tests to be run based on that saved state.

The --state switch requires an argument which must be a comma separated list of one or more of the following options.

last

Run the same tests as the last time the state was saved. This makes it possible, for example, to recreate the ordering of a shuffled test.

# Run all tests in random order
$ prove -b --state=save --shuffle

# Run them again in the same order
$ prove -b --state=last
failed

Run only the tests that failed on the last run.

# Run all tests
$ prove -b --state=save

# Run failures
$ prove -b --state=failed

If you also specify the save option newly passing tests will be excluded from subsequent runs.

# Repeat until no more failures
$ prove -b --state=failed,save
passed

Run only the passed tests from last time. Useful to make sure that no new problems have been introduced.

all

Run all tests in normal order. Multple options may be specified, so to run all tests with the failures from last time first:

$ prove -b --state=failed,all,save
hot

Run the tests that most recently failed first. The last failure time of each test is stored. The hot option causes tests to be run in most-recent- failure order.

$ prove -b --state=hot,save

Tests that have never failed will not be selected. To run all tests with the most recently failed first use

$ prove -b --state=hot,all,save

This combination of options may also be specified thus

$ prove -b --state=adrian
todo

Run any tests with todos.

slow

Run the tests in slowest to fastest order. This is useful in conjunction with the -j parallel testing switch to ensure that your slowest tests start running first.

$ prove -b --state=slow -j9
fast

Run test tests in fastest to slowest order.

new

Run the tests in newest to oldest order based on the modification times of the test scripts.

old

Run the tests in oldest to newest order.

fresh

Run those test scripts that have been modified since the last test run.

save

Save the state on exit. The state is stored in a file called .prove (_prove on Windows and VMS) in the current directory.

The --state switch may be used more than once.

$ prove -b --state=hot --state=all,save

--rules

The --rules option is used to control which tests are run sequentially and which are run in parallel, if the --jobs option is specified. The option may be specified multiple times, and the order matters.

The most practical use is likely to specify that some tests are not "parallel-ready". Since mentioning a file with --rules doesn't cause it to be selected to run as a test, you can "set and forget" some rules preferences in your .proverc file. Then you'll be able to take maximum advantage of the performance benefits of parallel testing, while some exceptions are still run in parallel.

--rules examples

# All tests are allowed to run in parallel, except those starting with "p"
--rules='seq=t/p*.t' --rules='par=**'

# All tests must run in sequence except those starting with "p", which should be run parallel
--rules='par=t/p*.t'

--rules resolution

  • By default, all tests are eligible to be run in parallel. Specifying any of your own rules removes this one.

  • "First match wins". The first rule that matches a test will be the one that applies.

  • Any test which does not match a rule will be run in sequence at the end of the run.

  • The existence of a rule does not imply selecting a test. You must still specify the tests to run.

  • Specifying a rule to allow tests to run in parallel does not make them run in parallel. You still need specify the number of parallel jobs in your Harness object.

--rules Glob-style pattern matching

We implement our own glob-style pattern matching for --rules. Here are the supported patterns:

** is any number of characters, including /, within a pathname
* is zero or more characters within a filename/directory name
? is exactly one character within a filename/directory name
{foo,bar,baz} is any of foo, bar or baz.
\ is an escape character

More advanced specifications for parallel vs sequence run rules

If you need more advanced management of what runs in parallel vs in sequence, see the associated 'rules' documentation in TAP::Harness and TAP::Parser::Scheduler. If what's possible directly through prove is not sufficient, you can write your own harness to access these features directly.

@INC

prove introduces a separation between "options passed to the perl which runs prove" and "options passed to the perl which runs tests"; this distinction is by design. Thus the perl which is running a test starts with the default @INC. Additional library directories can be added via the PERL5LIB environment variable, via -Ifoo in PERL5OPT or via the -Ilib option to prove.

Taint Mode

Normally when a Perl program is run in taint mode the contents of the PERL5LIB environment variable do not appear in @INC.

Because PERL5LIB is often used during testing to add build directories to @INC prove passes the names of any directories found in PERL5LIB as -I switches. The net effect of this is that PERL5LIB is honoured even when prove is run in taint mode.

FORMATTERS

You can load a custom TAP::Parser::Formatter:

prove --formatter MyFormatter

SOURCE HANDLERS

You can load custom TAP::Parser::SourceHandlers, to change the way the parser interprets particular sources of TAP.

prove --source MyHandler --source YetAnother t

If you want to provide config to the source you can use:

prove --source MyCustom \
      --source Perl --perl-option 'foo=bar baz' --perl-option avg=0.278 \
      --source File --file-option extensions=.txt --file-option extensions=.tmp t
      --source pgTAP --pgtap-option pset=format=html --pgtap-option pset=border=2

Each --$source-option option must specify a key/value pair separated by an =. If an option can take multiple values, just specify it multiple times, as with the extensions= examples above. If the option should be a hash reference, specify the value as a second pair separated by a =, as in the pset= examples above (escape = with a backslash).

All --sources are combined into a hash, and passed to "new" in TAP::Harness's sources parameter.

See TAP::Parser::IteratorFactory for more details on how configuration is passed to SourceHandlers.

PLUGINS

Plugins can be loaded using the -Pplugin syntax, eg:

prove -PMyPlugin

This will search for a module named App::Prove::Plugin::MyPlugin, or failing that, MyPlugin. If the plugin can't be found, prove will complain & exit.

You can pass arguments to your plugin by appending =arg1,arg2,etc to the plugin name:

prove -PMyPlugin=fou,du,fafa

Please check individual plugin documentation for more details.

Available Plugins

For an up-to-date list of plugins available, please check CPAN:

http://search.cpan.org/search?query=App%3A%3AProve+Plugin

Writing Plugins

Please see "PLUGINS" in App::Prove.