Re: Security Checks for CPAN Module Authors

This might not be as trivial as you'd imagine. For example, a module might pull in some unsafe hashing algorithm module (like MD5) dynamically when asked to do so or as fallback option. Depending on a lot of circumstances, this might be a huge security problem (passwords without salt) or it might be OK to do so in support of some nonsecurity-related legacy requirement. And in the case of your application, it might not even load the module, just require it to be installed "just in case".

perl -e 'use MIME::Base64; print decode_base64("4pmsIE5ldmVyIGdvbm5hIGdpdmUgeW91IHVwCiAgTmV2ZXIgZ29ubmEgbGV0IHlvdSBkb3duLi4uIOKZqwo=");'

Comment on Re: Security Checks for CPAN Module Authors Download Code

Replies are listed 'Best First'.
Re^2: Security Checks for CPAN Module Authors by localshop (Monk) on Oct 25, 2018 at 15:44 UTC
I was thinking a little less granular. For example if I run cpan-audit installed I see a warning for PathTools <3.62 so if I use File::Spec I simply enforce minimal version so that the Module user performs an update of this module. Actually that specific module probably not a great example as it's part of Core bundled packages but you get the idea. So wasn't thinking about going down to specific encryption algols etc but just looking at modules with versions that have security advisories that are simple enough to set minimal versions on without forcing a Perl version upgrade.	[reply]

Replies are listed 'Best First'.

Re^2: Security Checks for CPAN Module Authors
by localshop (Monk) on Oct 25, 2018 at 15:44 UTC

I was thinking a little less granular.

For example if I run cpan-audit installed I see a warning for PathTools <3.62 so if I use File::Spec I simply enforce minimal version so that the Module user performs an update of this module.

Actually that specific module probably not a great example as it's part of Core bundled packages but you get the idea. So wasn't thinking about going down to specific encryption algols etc but just looking at modules with versions that have security advisories that are simple enough to set minimal versions on without forcing a Perl version upgrade.

[reply]