in reply to Increase verbosity of "make test"

The problem you are trying to diagnose is due to a core perl bug in versions before 5.14. This is triggered by passing a tainted string to YAML::PP::Load, which is causing an infinite loop. On the test machines, it is eventually killed, which gives the status of 9 (SIGKILL).

Since YAML::PP is parsing the string, not using it in any unsafe way, you should be able to untaint the string before passing it to YAML::PP to avoid the bug. I've filed an issue on YAML::PP about this.

Replies are listed 'Best First'.
Re^2: Increase verbosity of "make test"
by bliako (Abbot) on Oct 11, 2023 at 14:34 UTC

    Thanks Haarg++ I would never be able to discover this. Great!

[reply]
Re^2: Increase verbosity of "make test"
by bliako (Abbot) on Oct 12, 2023 at 08:38 UTC

    In said module (Data::Roundtrip) I have one instance of feeding YAML::PP with a string. As per your suggestion I am now untainting the string thusly:

    sub yaml2perl {
  my $yaml_string = $_[0];
  ...
  ($yaml_string) = each %{{$yaml_string,0}};
  my $pv = eval { YAML::PP::Load($yaml_string) };
  ...
  return $pv
}

    [download]

    I was previously using YAML but it failed for an (extremely) corner case with a quotes-inside-quotes string. And so I went for YAML::PP as I did not want to use YAML::XS out of concern for users in not dev-friendly environments. YAML::PP does not have a problem with aforementioned corner case.

    I had another choice of restricting use of Data::Roundtrip for Perls >= 5.14. But I keep this as last resort.

    Any opinions welcome.

    Thank Haarg again for looking into this, bw, bliako

[reply]
[d/l]
      I did not want to use YAML::XS out of concern for users in not dev-friendly environments ... Any opinions welcome

      Well, since you are soliciting opinions it would be remiss not to mention that I've found YAML::XS to be significantly faster for parsing to the point where I have modified old, third-party code to use it in preference.

      It depends on your use case and that of other users of your code but you could consider employing one of the many options for conditional dependencies in this scenario rather than explicitly using the PP module.

      For clarity, YAML::PP and YAML::XS are not 100% API compatible so there may be a little work involved in supporting both, should you choose to do so.

      🦛

[reply]

        noted, thanks. I will take your advice and accommodate both. (which means different set of bugs depending on setup, thanks! :))

[reply]

In Section Seekers of Perl Wisdom