view release on metacpan or  search on metacpan

t/cgi_security.t  view on Meta::CPAN

	TODO: {
		local $TODO = 'DOCUMENTED LIMITATION: foo(undef) and foo() share the same cache entry (see LIMITATIONS in POD)';
		is($state->{misses}{$collapsed_key}, 1,
			'foo() should be a miss when only foo(undef) has been called');
	}
};

# ===========================================================================
# VECTOR 13 -- can() with Hostile Method Name from CGI Input
#
# Exploit: a CGI introspection endpoint might call
#   $cached->can($ENV{QUERY_STRING})
# A hostile method name containing shell chars, XSS, or path segments must not
# be executed -- can() delegates to UNIVERSAL::can which does a simple symbol-
# table lookup, returning undef for any name not defined in the package.
# No eval, no exec, no dynamic dispatch occurs inside can().
# ===========================================================================
subtest 'can() with hostile CGI method names returns undef without side effects' => sub {
	local %ENV = (%ENV, QUERY_STRING => "method=$CMD_INJECT");

	my $cached = _wrapped();