perl5223delta(1)

1PERL5223DELTA(1)       Perl Programmers Reference Guide       PERL5223DELTA(1)
2
3
4

NAME

6       perl5223delta - what is new for perl v5.22.3
7

DESCRIPTION

9       This document describes differences between the 5.22.2 release and the
10       5.22.3 release.
11
12       If you are upgrading from an earlier release such as 5.22.1, first read
13       perl5222delta, which describes differences between 5.22.1 and 5.22.2.
14

Security

16   -Di switch is now required for PerlIO debugging output
17       Previously PerlIO debugging output would be sent to the file specified
18       by the "PERLIO_DEBUG" environment variable if perl wasn't running
19       setuid and the -T or -t switches hadn't been parsed yet.
20
21       If perl performed output at a point where it hadn't yet parsed its
22       switches this could result in perl creating or overwriting the file
23       named by "PERLIO_DEBUG" even when the -T switch had been supplied.
24
25       Perl now requires the -Di switch to produce PerlIO debugging output.
26       By default this is written to "stderr", but can optionally be
27       redirected to a file by setting the "PERLIO_DEBUG" environment
28       variable.
29
30       If perl is running setuid or the -T switch was supplied "PERLIO_DEBUG"
31       is ignored and the debugging output is sent to "stderr" as for any
32       other -D switch.
33
34   Core modules and tools no longer search "." for optional modules
35       The tools and many modules supplied in core no longer search the
36       default current directory entry in @INC for optional modules.  For
37       example, Storable will remove the final "." from @INC before trying to
38       load Log::Agent.
39
40       This prevents an attacker injecting an optional module into a process
41       run by another user where the current directory is writable by the
42       attacker, e.g. the /tmp directory.
43
44       In most cases this removal should not cause problems, but difficulties
45       were encountered with base, which treats every module name supplied as
46       optional.  These difficulties have not yet been resolved, so for this
47       release there are no changes to base.  We hope to have a fix for base
48       in Perl 5.22.4.
49
50       To protect your own code from this attack, either remove the default
51       "."  entry from @INC at the start of your script, so:
52
53         #!/usr/bin/perl
54         use strict;
55         ...
56
57       becomes:
58
59         #!/usr/bin/perl
60         BEGIN { pop @INC if $INC[-1] eq '.' }
61         use strict;
62         ...
63
64       or for modules, remove "." from a localized @INC, so:
65
66         my $can_foo = eval { require Foo; }
67
68       becomes:
69
70         my $can_foo = eval {
71             local @INC = @INC;
72             pop @INC if $INC[-1] eq '.';
73             require Foo;
74         };
75

Incompatible Changes

77       Other than the security changes above there are no changes
78       intentionally incompatible with Perl 5.22.2.  If any exist, they are
79       bugs, and we request that you submit a report.  See "Reporting Bugs"
80       below.
81

Modules and Pragmata

83   Updated Modules and Pragmata
84       •   Archive::Tar has been upgraded from version 2.04 to 2.04_01.
85
86       •   bignum has been upgraded from version 0.39 to 0.39_01.
87
88       •   CPAN has been upgraded from version 2.11 to 2.11_01.
89
90       •   Digest has been upgraded from version 1.17 to 1.17_01.
91
92       •   Digest::SHA has been upgraded from version 5.95 to 5.95_01.
93
94       •   Encode has been upgraded from version 2.72 to 2.72_01.
95
96       •   ExtUtils::Command has been upgraded from version 1.20 to 1.20_01.
97
98       •   ExtUtils::MakeMaker has been upgraded from version 7.04_01 to
99           7.04_02.
100
101       •   File::Fetch has been upgraded from version 0.48 to 0.48_01.
102
103       •   File::Spec has been upgraded from version 3.56_01 to 3.56_02.
104
105       •   HTTP::Tiny has been upgraded from version 0.054 to 0.054_01.
106
107       •   IO has been upgraded from version 1.35 to 1.35_01.
108
109       •   The IO-Compress modules have been upgraded from version 2.068 to
110           2.068_001.
111
112       •   IPC::Cmd has been upgraded from version 0.92 to 0.92_01.
113
114       •   JSON::PP has been upgraded from version 2.27300 to 2.27300_01.
115
116       •   Locale::Maketext has been upgraded from version 1.26 to 1.26_01.
117
118       •   Locale::Maketext::Simple has been upgraded from version 0.21 to
119           0.21_01.
120
121       •   Memoize has been upgraded from version 1.03 to 1.03_01.
122
123       •   Module::CoreList has been upgraded from version 5.20160429 to
124           5.20170114_22.
125
126       •   Net::Ping has been upgraded from version 2.43 to 2.43_01.
127
128       •   Parse::CPAN::Meta has been upgraded from version 1.4414 to
129           1.4414_001.
130
131       •   Pod::Html has been upgraded from version 1.22 to 1.2201.
132
133       •   Pod::Perldoc has been upgraded from version 3.25 to 3.25_01.
134
135       •   Storable has been upgraded from version 2.53_01 to 2.53_02.
136
137       •   Sys::Syslog has been upgraded from version 0.33 to 0.33_01.
138
139       •   Test has been upgraded from version 1.26 to 1.26_01.
140
141       •   Test::Harness has been upgraded from version 3.35 to 3.35_01.
142
143       •   XSLoader has been upgraded from version 0.20 to 0.20_01, fixing a
144           security hole in which binary files could be loaded from a path
145           outside of @INC.  [GH #15418]
146           <https://github.com/Perl/perl5/issues/15418>
147

Documentation

149   Changes to Existing Documentation
150       perlapio
151
152       •   The documentation of "PERLIO_DEBUG" has been updated.
153
154       perlrun
155
156       •   The new -Di switch has been documented, and the documentation of
157           "PERLIO_DEBUG" has been updated.
158

Testing

160       •   A new test script, t/run/switchDx.t, has been added to test that
161           the new -Di switch is working correctly.
162

Selected Bug Fixes

164       •   The "PadlistNAMES" macro is an lvalue again.
165

Acknowledgements

167       Perl 5.22.3 represents approximately 9 months of development since Perl
168       5.22.2 and contains approximately 4,400 lines of changes across 240
169       files from 20 authors.
170
171       Excluding auto-generated files, documentation and release tools, there
172       were approximately 2,200 lines of changes to 170 .pm, .t, .c and .h
173       files.
174
175       Perl continues to flourish into its third decade thanks to a vibrant
176       community of users and developers.  The following people are known to
177       have contributed the improvements that became Perl 5.22.3:
178
179       Aaron Crane, Abigail, Alex Vandiver, Aristotle Pagaltzis, Chad Granum,
180       Chris 'BinGOs' Williams, Craig A. Berry, David Mitchell, Father
181       Chrysostomos, James E Keenan, Jarkko Hietaniemi, Karen Etheridge, Karl
182       Williamson, Matthew Horsfall, Niko Tyni, Ricardo Signes, Sawyer X,
183       Stevan Little, Steve Hay, Tony Cook.
184
185       The list above is almost certainly incomplete as it is automatically
186       generated from version control history.  In particular, it does not
187       include the names of the (very much appreciated) contributors who
188       reported issues to the Perl bug tracker.
189
190       Many of the changes included in this version originated in the CPAN
191       modules included in Perl's core.  We're grateful to the entire CPAN
192       community for helping Perl to flourish.
193
194       For a more complete list of all of Perl's historical contributors,
195       please see the AUTHORS file in the Perl source distribution.
196

Reporting Bugs

198       If you find what you think is a bug, you might check the articles
199       recently posted to the comp.lang.perl.misc newsgroup and the Perl bug
200       database at https://rt.perl.org/ .  There may also be information at
201       http://www.perl.org/ , the Perl Home Page.
202
203       If you believe you have an unreported bug, please run the perlbug
204       program included with your release.  Be sure to trim your bug down to a
205       tiny but sufficient test case.  Your bug report, along with the output
206       of "perl -V", will be sent off to perlbug@perl.org to be analysed by
207       the Perl porting team.
208
209       If the bug you are reporting has security implications, which make it
210       inappropriate to send to a publicly archived mailing list, then please
211       send it to perl5-security-report@perl.org.  This points to a closed
212       subscription unarchived mailing list, which includes all the core
213       committers, who will be able to help assess the impact of issues,
214       figure out a resolution, and help co-ordinate the release of patches to
215       mitigate or fix the problem across all platforms on which Perl is
216       supported.  Please only use this address for security issues in the
217       Perl core, not for modules independently distributed on CPAN.
218