Looking at tachyon's post, I see that this if statement is followed by a call to quotemeta. I expect that's what is causing the problem; quotemeta() backslashes everything except word characters, so it might use a function called IsWord to figure out if a certain UTF8 character should be backslashes or not.

Unfortunately, I don't know why the IsWord function has not been loaded. You may want to produce a small test case and submit a bug report using the perlbug utility that comes with Perl.

Thanks for the feedback so far. I tried to simulate the problem with the following piece of code:



#!/usr/bin/perl -w
print "Content-Type: text/html\n\n";

my $value = "ciaoslave";
my $allowed = '[\w\d\s\-]{1,15}';
my $escape  = "yes";

if($value =~ /^$allowed$/){
        print (($escape eq "no") ? $value : quotemeta($value));
}else{
        print "Fail!";
}
print "\n";
[download]


When I call this script through a webbrowser it works.. and does not give the error that occurred earlier.

Perhaps the XML::Simple module effects the behaviour in some way ?

Thanks again,
- Pitr

Replacing '\w' by 'a-zA-Z' seems to do it - One step closer to the solution :)
Pitr

perl -wle 'BEGIN { $SIG{__DIE__} = sub { print "Catched SIGDIE: @_";ex
+it(-1) }} use utf8; /^\w$/;'
[download]


Results in:


Catched SIGDIE: Can't locate object method "IsWord" via package "main"
+ (perhaps you forgot to load "main"?) at /usr/local/lib/perl5/5.6.1/u
+tf8_heavy.pl line 30.
[download]


This code illustrates the problem: the eval() done by utf8_heavy.pl fails and calls the die-handler which is set within the BEGIN block. I think this should not happen, because the 'die' within eval() is in a different scope than the position where the Die-handler is set.

We need more information. What makes you think the line you give is the source of the error? It does not look like it to me. If it *really* is (ie comment this line out and see if your error goes away) what is the value in $allowed and what is the value in $value? and how do you set $allowed

Update

Further to CB discussion here is the code (relevant bit first followed by entire prog), the var $allowed is passed from the client and used to validate client input which is very insecure.

sub validate($$){
    my($self,$name) = @_;

    if(! defined($self->{params}->{$name}) ){
        return $self->setError("'$name' was not given.");
    }

    my $value = $self->{params}->{$name} || 
            $self->{params}->{retvals}->{$name};
            

    my $field = $self->getField($name);
    my $allowed = $field->{allowed};
    my $comment = $field->{comment};
    my $escape  = $field->{escape} || "yes"; 

    if($value =~ /^$allowed$/){
       return (($escape eq "no") ? $value : quotemeta($value));
    }elsif(! $allowed){
       return $self->setError("No constraints defined for '$name'");
    }else{
       return $self->setError("Forbidden characters in $name: '".
         quotemeta($value)."' ". ($comment ? "($comment)" : ""));
    }
}
[download]

Here is the whole thing