#!/usr/bin/perl

use strict;
use warnings;
use CGI::Upload; 
use Number::Bytes::Human qw(format_bytes);
 
my $file = shift @ARGV;

my $upload = CGI::Upload->new;
$upload->file_name( "$file" );

my $h = Number::Bytes::Human->new();
my $h_size = format_bytes(-s $file);
print $h_size, "\n";
[download]

Hey Khen, thanks for the reply!

Tell me, wich security reasons? You mean it does some security checks? (I didn't find it in the docs)

Also, folks, I think the reason I interpreted from the issue was the opposite: the my $q = new CGI; inside the sub probably emptied the POSTed data that was captured by the my $q = new CGI; in the beginning of the main script.

Curious thing is that it only bothers the upload() method, and not the param(). That shall make a lot of people go crazy.

Thanks

André

Which security reasons?

You'll find the reasons in the PRAGMAS subsection. Look for -private_tempfiles. Here, quoting the documentation:

-private_tempfiles

"CGI.pm can process uploaded file. Ordinarily it spools the uploaded file to a temporary directory, then deletes the file when done. However, this opens the risk of eavesdropping as described in the file upload section. Another CGI script author could peek at this data during the upload, even if it is confidential information. On Unix systems, the -private_tempfiles pragma will cause the temporary file to be unlinked as soon as it is opened and before any data is written into it, reducing, but not eliminating the risk of eavesdropping (there is still a potential race condition). To make life harder for the attacker, the program chooses tempfile names by calculating a 32 bit checksum of the incoming HTTP headers".

"To ensure that the temporary file cannot be read by other CGI scripts, use suEXEC or a CGI wrapper program to run your script. The temporary file is created with mode 0600 (neither world nor group readable)".

along a similar vein of thinking...have you turned on some debugging output for CGI.pm and or checked your webserver logs? run the CGI from command line?..i think you can even provide the file upload parameter on command line. is the file upload form parameter being passed into the CGI for sure? sniff the network with wireshark? check webserver config is not pointing to older (incompatible) .dll/.exe for perl. also check the upgraded perl doesn't point to older modules somehow/somewhere.
i'm sure you know all these things to check..probably just stressed out too much. just remembered another useful thing: run Filemon utility and check the log, possibility of a file permission issue.
good luck.
the hardest line to type correctly is: stty erase ^H

Hey bart, hey aquarium

Thanks for the replies!

I've just found the cure.

Before that part of the code, I had a sub that initiated the CGI object within itself. For example:

#!/usr/bin/perl -wT

use CGI; my $q = new CGI;

#...

my ( $user_id, $name ) = identify ( $auth_token );

# ...

my $fh = $q->upload( "file" );
my $filesize = -s $fh;
die $filesize; # undef at debugging!
# ... file read routines, that resulted blank after the upgrade
[download]

Then, on my personal lib, mylib1.pm, I had this subroutine:

sub identify {
   my $token = shift;

   # my $q = new CGI; # it started working when I removed this line!

   # identification routines

   # some calls to CGI.pm methods, where I used $q
}
[download]

After hours of mystery, I decided to remove this inner initialization. And it worked! I'm now passing $q as a parameter to the sub.

sub identify {
   my $token = shift;
   my $q = shift; # and including this element on the sub call, of cou
+rse

   my $q = new CGI; # it started working when I removed this line!

   # identification routines

   # some calls to CGI.pm methods, where I used $q
}
[download]

Tell me, guys, what's the explanation? Is this a bug on CGI.pm garbage collection or is it the case that I was doing ugly things.

Funny is that it worked with 5.8.7.

Thanks

Andre

Uh, creating a CGI object effectively reads the data from the input. After that, it is gone, when the data is POSTed (as is necessary for file upload) — you may repeat reading parameters from GET.

It's not a matter of garbage collecting, it's a matter of a physical action performed when creating the object. An action that cannot stand being repeated.