From nabijaczleweli@nabijaczleweli.xyz Sat Oct 19 19:29:40 2024
Date: Sat, 19 Oct 2024 19:29:40 +0200
From: =?utf-8?B?0L3QsNCx?= <nabijaczleweli@nabijaczleweli.xyz>
To: ~nabijaczleweli/ossp@lists.sr.ht
Cc: abe@debian.org, perl-eperl-maintainers@fedoraproject.org, 
	bofh@freebsd.org
Subject: ePerl [2.2.0, 2.2.14] input sanitisation bug causes unintended
 potentially-remote code execution vulnerability
Message-ID: <vbemeg42slelczbsq3dggk5f77qw4k7fpbtwlbozdaxivkwjlc@tarta.nabijaczleweli.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="dx4zb2vbdm5sez7h"
Content-Disposition: inline
User-Agent: NeoMutt/20231221-2-4202cf-dirty


--dx4zb2vbdm5sez7h
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

(a) ossp-eperl is a macro system for embedding Perl code within text docume=
nts
    for example, a file like
      abc
      <: print 2*3 :>
      def
    turns into a perl program similar to
      print "abc\n";
      print 2*3; print "\n";
      print "def\n";
    which is then evaluated to produce
      abc
      6
      def
(b) eperl has a C-like preprocessor that has
    #include (normal) and #sinclude ("safe") directives
(c) as with the C preprocessor, inclusions are recursive=20
    for a file structure of
      a1: #include b1
      b1: #include c1
      c1: <: system('id') :>
    preprocessing a1 yields a file consisting of
      <: system('id') :>
    that then gets turned into perl program=20
    	system('id');
    that does what one'd expect
(d) "safe" inclusions are identical, except they remove the begin/end tags
    (this notice uses <:/:> but they can differ sometimes)
(e) they do /not/ remove the would-be contents of the tags,
    it's effectively a s/<://g s/:>//g operation on the result, so given
      a1s: #sinclude b1
    preprocessing a1s yields a file consisting of
       system('id')
    that then gets turned into perl program=20
    	print " system('id'); \n";
    which also does what one'd expect
(f) files prefixed with "http://" are processed specially by issuing an HTT=
P GET
    so a1/a1s could just as well have said
      #include http://hinfo.network/index.html

This is all documented behaviour. It's also quite dangerous.
Debian attempts to patch this seemingly-known bug, saying
  eperl (2.2.14-3) unstable; urgency=3Dlow
 =20
    * The #sinclude directive calling an external server could allow
      execution of arbitrary code (Bug reported by David Madison on the
      ePerl mailing list).
 =20
   -- Denis Barbier <barbier@debian.org>  Sat, 16 Jun 2001 00:29:53 +0200
with
  --- eperl-2.2.14.orig/eperl_pp.c
  +++ eperl-2.2.14/eperl_pp.c
  @@ -278,6 +281,11 @@
                           cp3 +=3D l1;
                       else if (strncasecmp(cp3, ePerl_end_delimiter, l2) =
=3D=3D 0)
                           cp3 +=3D l2;
  +                    else if (strncmp(cp3, "#include", 8) =3D=3D 0) {
  +                        /*  Replace all occurences of #include by #sincl=
ude */
  +                        strcpy(cp4, "#sinclude");
  +                        cp4 +=3D 9;
  +                    }
                       else
                           *cp4++ =3D *cp3++;
                   }
full context at
  https://git.sr.ht/~nabijaczleweli/ossp-eperl/tree/ePerl_2_2_14/item/eperl=
_pp.c#L271
but the relevant bit is
                   /* recursive usage */
                   if ((cp =3D ePerl_PP_Process(caName, cppINC, 0 /*mode=3D=
file*/)) =3D=3D NULL)
                       return NULL;
  =20
                   /* make it secure by removing all begin/end delimiters!!=
 */
                   if ((cp2 =3D (char *)malloc(strlen(cp))) =3D=3D NULL)
                       return NULL;
                   l1 =3D strlen(ePerl_begin_delimiter);
                   l2 =3D strlen(ePerl_end_delimiter);
                   for (cp3 =3D cp, cp4 =3D cp2; *cp3 !=3D NUL; ) {
                       if (strncasecmp(cp3, ePerl_begin_delimiter, l1) =3D=
=3D 0)
                           cp3 +=3D l1;
                       else if (strncasecmp(cp3, ePerl_end_delimiter, l2) =
=3D=3D 0)
                           cp3 +=3D l2;
                       else
                           *cp4++ =3D *cp3++;
                   }

It's not necessarily easy to see, but it is obvious once you notice,
that all this does is actually just damage the result,
and doesn't change anything formally:
ePerl_PP_Process() returns a fully-preprocessed result
(#-directives removed and resolved),
and cp2/cp4 are copied to the output verbatim.

I can't seem to find the "ePerl mailing list" but it's been 23 years;
The vulnerability can be triggered with the obvious conclusion that
(g) if you instead do
      a2: #sinclude b2
      b2: #include c2
      c2: <<:: system('id') ::>>
    preprocessing a2 yields a file consisting of
      <: system('id') :>
    that then gets turned into perl program=20
      system('id')
    oops!
(tbc the same applies if a2 instead said "#include c2",
 but this further illustrates that the Debian patch is meaningless).

The manual recommends using #sinclude for data you don't trust (hence, http=
://...):
  https://srhtcdn.githack.com/~nabijaczleweli/ossp-eperl/blob/13ef21849157b=
cb160de27c88f39402cd4b5edbc/ossp-eperl.pdf#page=3D7

This bug wouldn't be anything out of the ordinary:
it's been 23 years since the original report (and 27 since the bug was intr=
oduced),
and the only use-case for eperl is wml =E2=80=92 no-one is using http inclu=
des there =E2=80=92
but Debian actually purports to fix this,
so this was first reported to debian-security@ on 2024-09-22.

This behaviour is present in all ePerl versions since 2.2.0 (1997-07-18)
(previous versions didn't have a preprocessor:
 https://git.sr.ht/~nabijaczleweli/ossp-eperl/tree/tarballs/item/NEWS#L64
 https://git.sr.ht/~nabijaczleweli/ossp-eperl/tree/tarballs/item/ChangeLog#=
L341-505)
and, thus, AFAICT, every version ever distributed by anyone.

Upcoming ossp-eperl 2.2.15 fixes this with
commit 5971b87 ("Fix #sinclude to /actually/ remove all delimiters. Add tes=
t to validate this")
<https://git.sr.ht/~nabijaczleweli/ossp-eperl/commit/5971b873fcfd34e51d8c16=
05b3a58e006538eb05>
(please cf. https://sr.ht/~nabijaczleweli/ossp for more about the new upstr=
eam).

Backports are included below.

bpo-2.2.14.diff           is based against 2.2.14
bpo-Debian-2.2.14-24.diff is based against Debian 2.2.14-24
                          (and the current Fedora patch bundle(?),
                           since it includes Debian 2.2.14-15.1 wholesale)

The patch against 2.2.14 also fixes an overflow if #sincluded data
contains more #include directives than space is left by the removed delimit=
ers.

Neither patch fixes strncasecmp() always being used,
regardless of current delimiter-casedness configuration,

The patch against Debian doesn't fix the "#include" =3D> "#sinclude" mangli=
ng
(it's easy to rip out, but the test also tests it, so rip that out too).

Such is the nature of a backport. At least it reduces the working set.

-- >8 --                        bpo-2.2.14.diff                         -- =
>8 --
diff --git a/eperl_pp.c b/eperl_pp.c
index c4061ae..90d9db2 100644
--- a/eperl_pp.c
+++ b/eperl_pp.c
@@ -269,21 +269,13 @@ char *ePerl_PP_Process(char *cpInput, char **cppINC, =
int mode)
                     return NULL;
=20
                 /* make it secure by removing all begin/end delimiters!! */
-                if ((cp2 =3D (char *)malloc(strlen(cp))) =3D=3D NULL)
+                if ((cp =3D (char *)realloc(cp, strlen(cp)*9/8+1)) =3D=3D =
NULL)
                     return NULL;
-                l1 =3D strlen(ePerl_begin_delimiter);
-                l2 =3D strlen(ePerl_end_delimiter);
-                for (cp3 =3D cp, cp4 =3D cp2; *cp3 !=3D NUL; ) {
-                    if (strncasecmp(cp3, ePerl_begin_delimiter, l1) =3D=3D=
 0)
-                        cp3 +=3D l1;
-                    else if (strncasecmp(cp3, ePerl_end_delimiter, l2) =3D=
=3D 0)
-                        cp3 +=3D l2;
-                    else
-                        *cp4++ =3D *cp3++;
-                }
-                *cp4 =3D NUL;
-                free(cp);
-                cp =3D cp2;
+#define KILLDEL(delimiter) \
+                while ((cp2 =3D strcasestr(cp, delimiter))) \
+                    memmove(cp2, cp2 + strlen(delimiter), (strlen(cp) + 1)=
 - (cp2 - cp) - strlen(delimiter));
+                KILLDEL(ePerl_begin_delimiter)
+                KILLDEL(ePerl_end_delimiter)
             }
             else if (strncmp(cp, "#if", 3) =3D=3D 0) {
                 /*=20
diff --git a/t/11_validate_sinclude.t b/t/11_validate_sinclude.t
new file mode 100644
index 0000000..01774a7
--- /dev/null
+++ b/t/11_validate_sinclude.t
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: 0BSD
+require "TEST.pl";
+TEST::init();
+
+print "1..1\n";
+
+$included2 =3D TEST::tmpfile(<<"EOF");
+<<::system("id")::>>
+EOF
+
+$included =3D TEST::tmpfile(<<"EOF");
+<:=3D"A":>
+#include $included2
+<:=3D"B":>
+EOF
+
+$basefile =3D TEST::tmpfile(<<"EOF");
+a
+#sinclude $included
+b
+EOF
+
+$result =3D `../eperl -P $basefile`;
+
+$want =3D <<"EOF";
+a
+=3D"A"
+system("id")
+=3D"B"
+b
+EOF
+print ($want eq $result ? "ok" : "not ok");
+
+TEST::cleanup();

-- >8 --                   bpo-Debian-2.2.14-24.diff                    -- =
>8 --
diff --git a/eperl_pp.c b/eperl_pp.c
index 644bb30..5928eea 100644
--- a/eperl_pp.c
+++ b/eperl_pp.c
@@ -272,26 +272,17 @@ char *ePerl_PP_Process(char *cpInput, char **cppINC, =
int mode)
                     return NULL;
=20
                 /* make it secure by removing all begin/end delimiters!! */
-                if ((cp2 =3D (char *)malloc(strlen(cp)*9/8)) =3D=3D NULL)
+                if ((cp =3D (char *)realloc(cp, strlen(cp)*9/8+1)) =3D=3D =
NULL)
                     return NULL;
-                l1 =3D strlen(ePerl_begin_delimiter);
-                l2 =3D strlen(ePerl_end_delimiter);
-                for (cp3 =3D cp, cp4 =3D cp2; *cp3 !=3D NUL; ) {
-                    if (strncasecmp(cp3, ePerl_begin_delimiter, l1) =3D=3D=
 0)
-                        cp3 +=3D l1;
-                    else if (strncasecmp(cp3, ePerl_end_delimiter, l2) =3D=
=3D 0)
-                        cp3 +=3D l2;
-                    else if (strncmp(cp3, "#include", 8) =3D=3D 0) {
-                        /*  Replace all occurences of #include by #sinclud=
e */
-                        strcpy(cp4, "#sinclude");
-                        cp4 +=3D 9;
-                    }
-                    else
-                        *cp4++ =3D *cp3++;
+#define KILLDEL(delimiter) \
+                while ((cp2 =3D strcasestr(cp, delimiter))) \
+                    memmove(cp2, cp2 + strlen(delimiter), (strlen(cp) + 1)=
 - (cp2 - cp) - strlen(delimiter));
+                KILLDEL(ePerl_begin_delimiter)
+                KILLDEL(ePerl_end_delimiter)
+                while ((cp2 =3D strstr(cp, "#include"))) {
+                    memmove(cp2 + sizeof("#sinclude")-1, cp2 + sizeof("#in=
clude")-1, (strlen(cp) + 1) - (cp2 - cp) - (sizeof("#include")-1));
+                    memcpy(cp2, "#sinclude", sizeof("#sinclude")-1);
                 }
-                *cp4 =3D NUL;
-                free(cp);
-                cp =3D cp2;
             }
             else if (strncmp(cp, "#if", 3) =3D=3D 0) {
                 /*=20
diff --git a/t/11_validate_sinclude.t b/t/11_validate_sinclude.t
new file mode 100644
index 0000000..1235f99
--- /dev/null
+++ b/t/11_validate_sinclude.t
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: 0BSD
+require "TEST.pl";
+TEST::init();
+
+print "1..1\n";
+
+$included2 =3D TEST::tmpfile(<<"EOF");
+<<::system("id#include")::>>
+EOF
+
+$included =3D TEST::tmpfile(<<"EOF");
+<:=3D"A":>
+#include $included2
+<:=3D"B":>
+EOF
+
+$basefile =3D TEST::tmpfile(<<"EOF");
+a
+#sinclude $included
+b
+EOF
+
+$result =3D `../eperl -P $basefile`;
+
+$want =3D <<"EOF";
+a
+=3D"A"
+system("id#sinclude")
+=3D"B"
+b
+EOF
+print ($want eq $result ? "ok" : "not ok");
+
+TEST::cleanup();

--dx4zb2vbdm5sez7h
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmcT7IEACgkQvP0LAY0m
WPG0ghAAjtWVafhZ8nU46fMMxDxZ59XmBf36fpQLOue09IEsJXArIZA/xam4Wqxf
vOMgvYXp4+ip5YSbN5knJqdQDKbScFd5/NLKDF2TFjhmlmib8+Lb9mOki/1aXnWd
txUfkwYdIozZCsd2w3GhnoBQoVyDTywceQvUVjuCjw8mz5QWN3XxbJe6pyO4+EkA
fS+niLT5c3g1+U/q3W+85ijKkLUMapOkQrsTvUEN7nMaHIMYWXiWIt8MIXSSArhT
uhipUCv5u7KRqxGj1XMQKWr1li82W4c//mClpl2lLw8m6g5i4a4UV45PDDsfzzfo
lWmag2Aj0oZqyvPyz0tMwY5bTp8GIuQw9rnqAlERUmB0hAEA9Bkaw0i20z3uO5Cz
xBEMpdD+VUEk7D8pNSLHOknADiWsOaSdk7BTJKGUs+EUUDRw/GZf1yFftTW3dysW
BWLNzEr5YXFp0z+T9vixrU08W92C+cYxHRRBbpERrY2NF8FqD8lS0ABvypoAX3Gv
kxHtQY6kM9mZLL7ZZr2AKI48GofNk2Y+AVQNw9fJDfS6OSe4wqUTVlv8Qz/wN/RH
p3GMDUqYVleW8r8qikzRT2ucNJZrBmO+X+diqlnEBOKHt4z/8X9M4Dsr9Cs0/bGQ
db2cUXXEX425RVaXGMh7oFivyu9k8D/iysjrWdVtw8AYVKHaxFs=
=5/5R
-----END PGP SIGNATURE-----

--dx4zb2vbdm5sez7h--

From nabijaczleweli@nabijaczleweli.xyz Sat Oct 19 19:50:42 2024
Date: Sat, 19 Oct 2024 19:50:42 +0200
From: =?utf-8?B?0L3QsNCx?= <nabijaczleweli@nabijaczleweli.xyz>
To: ~nabijaczleweli/ossp@lists.sr.ht
Subject: ossp-eperl 2.2.15 released
Message-ID: <aqkuk3uvsiebxi5fwcvhy2wtpih3aejvebw3t4r4p7xk2ju7hf@tarta.nabijaczleweli.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="m2uedje4qllpx33n"
Content-Disposition: inline
User-Agent: NeoMutt/20231221-2-4202cf-dirty


--m2uedje4qllpx33n
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

This is the first thawed release as part of the new upstream,
and archive (and continued development) of http://www.ossp.org software.
Please see
  https://sr.ht/~nabijaczleweli/ossp
to learn more.

Old ossp-eperl tarballs are retained at
  https://lfs.nabijaczleweli.xyz/0022-OSSP.org-mirror/ftp.ossp.org/ossp-ftp=
/pkg/tool/eperl
the new release tarball (and signature, same as this mail) can be obtained =
=66rom
  https://git.sr.ht/~nabijaczleweli/ossp-eperl/refs/ePerl_2_2_15
The manual is available on-line and at
  https://srhtcdn.githack.com/~nabijaczleweli/ossp-eperl/blob/man/ossp-eper=
l.pdf

As standard fare, the detailed changelog/version/contributor history and NE=
WS
are now maintained as part of the tags and these release mails
(the old files have been inlined as appropriate).

This release:
 0. fixes #sinclude to /actually/ remove all delimiters:
      on every version with the preprocessor (2.2+)
      $ A: #sinclude B
      $ B: <<::system("id")::>>
      $ eperl -P A
      executed id
    (potentially-remote code execution introduced in 2.2.0:
     https://lists.sr.ht/~nabijaczleweli/ossp/%3Cvbemeg42slelczbsq3dggk5f77=
qw4k7fpbtwlbozdaxivkwjlc@tarta.nabijaczleweli.xyz%3E)
 1. removes the embedded GNU getopt (whose LGPL-2.1-or-later licence
    turned the overall "Artistic-1.0-Perl OR GPL-2.0-only" into just GPL)
 2. supports modern Perl (5.36.0)
 3. removes Apache::ePerl (it's for Apache 1 which was removed in lenny (20=
09))
 4. fixes every fixed-size buffer and behaviour in multi-threaded Perl
    (which usually had the side-effect of memory corruption if blown)
 5. reworks the build system so you get everything from the top-level autoc=
onf
    (also configure --with-allowed-caller-uids=3D"nobody, root, www-data")
 6. returns all HTTP responses with CR LF status line/headers
 7. stops disabling Perl STDOUT buffering
 8. stops having like 7 non-O_CLOEXEC file descriptors
 9. fixes Y2K
10. file descriptor 11/12 being always overridden with original stdin/stdout
11. fixes $SCRIPT_SRC_{PATH,URL}{,_DIR}
12. correctly implements setting the process title (need setproctitle(3))
13. fixes #sinclude tag elimination not obeying -i (always case-insensitive)
14. fixes &yuml; being soft hyphen (=C2=AD) instead of y umlaut (=C3=BF)
15. fixes entity decoding not working... sometimes? with adjacent entitites
16. fixes HEAD requests not having headers
17. fixes Parse::ePerl::Preprocess() and ::PP() universally segfaulting
18. fixes #c comments to behave as documented and remove the line outright
19. allows the first line of output to be an HTTP status line in NPH mode
    ("HTTP/1.[01] 123 Status Name") instead of always responding 200
20. Parse::ePerl::Preprocess() takes optional BeginDelimiter/EndDelimiter=
=20
                ::PP()         takes optional begin/end delimiter scalars
                               (both default to <: & :>)

This release is believed to fix every outstanding issue
(reported to upstream/Debian/Fedora/Gentoo (the latter two had none)),
and to incorporate or supersede every downstream patch.

  These bugs were fixed:
https://todo.sr.ht/~nabijaczleweli/ossp/219 abspath() ($SCRIPT_SRC_{PATH,UR=
L}{_DIR}) appends directory bit of relative path twice
https://todo.sr.ht/~nabijaczleweli/ossp/220 $SCRIPT_SRC_URL_DIR isn't (it's=
 the same as $SCRIPT_SRC_URL)=20
Debian#1080494                              eperl: unsubstituted version in=
 manual=20
Debian#1082546                              /usr/share/doc/eperl/utils/del2=
del: doesn't compile with modern perl (also it should be executable probabl=
y)

-- >8 --                              NEWS                              -- =
>8 --
  Major Changes from ePerl Version 2.2 to 2.3
  =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

  o  ....

  Major Changes from ePerl Version 2.1 to 2.2
  =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

  o  Changed Quotation/Delimiter Parsing

     Now again (as in 2.0.3) ePerl block end delimiters are found via plain
     forward character search. Quoted strings are no more recognized.  The
     reason behind this change is that constructs with odd number of quoting
     characters are more often seen in practice than end delimiters in quot=
ed
     strings (at least when using non-trivial delimiters).  And it is easier
     to escape the end delimiter in quoted strings (e.g. via backslashes) t=
han
     to rewrite a existing complex Perl construct with odd number of quotes
     (e.g. m|"[^"]+"|).=20

     The advantage: A lot of scripts with complex Perl constructs (which ne=
ver
     worked with ePerl in the past) now run out-of-the-box, too.  The
     disadvantage: Scripts which have the end delimiter in a quoted string =
are
     broken now.  You have to escape it to fix your script.

     Additionally to be more flexible with some special delimiter variants
     like <script language=3D"ePerl">..</script> a new option -i was added =
to
     ePerl to make the delimiters case-insensitive.

  o  Smarter and Optimized Parser

     Now ePerl recognizes final semicolons and automatically adds one if
     missing. So <: cmd; cmd :> now is also valid syntax. And the ePerl par=
ser
     now strips off unnecessary whitespaces both at the begin and end of a
     block. This now results in much cleaner translated Perl scripts.
     Additionally the parser was slightly optimized by no longer producing
     useless ``print "";'' constructs.=20

  o  Support for '=3D' block prefix
 =20
     Now <:=3D XXX :> (assuming the default delimiters but works with any)
     automatically is converted to "<: print XXX; :>".  Use this shortcut to
     interpolate a variable in a more shorter way via <:=3D$variable:> inst=
ead
     of the long and annoying <: print $variable; :>. Very useful within CGI
     scripts to shorten the ePerl stuff, for instance
     <?=3D$ENV{SCRIPT_SRC_MODIFIED_ISOTIME}!>.

  o  HTML entity conversion inside ePerl blocks

     ePerl now provides the special option -C for enabling a HTML entity
     conversion which is applied inside ePerl blocks before parsing. This
     option is automatically used in (NPH-)CGI mode.

     The solved problem here is the following: When you use ePerl as a
     Server-Side-Scripting-Language for HTML pages and you edit your ePerl
     source files via a HTML editor, the chance is high that your editor
     translates some entered characters to HTML entities, for instance ``<''
     to ``&lt;''.  This leads to invalid Perl code inside ePerl blocks,
     because the HTML editor has no knowledge about ePerl blocks. Using this
     option the ePerl parser automatically converts all entities found insi=
de
     ePerl blocks back to plain characters, so the Perl interpreter again
     receives valid Perl code blocks.

  o  Perl Taint and Warning modes now available

     Now ePerl has two new options similar to the plain ``perl'' program:
     Option -T for enabling the Tainting mode and option -w for enabling
     Warning messages of the Perl interpreter.=20

  o  New ePerl Preprocessor

     ePerl now provides an own preprocessor similar to F<CPP> (from the C
     language) in style which is either enabled manually via the new option=
 -P
     or automatically when ePerl runs in (NPH-)CGI mode.  The following
     directives are provided:
         #include path, #sinclude path .......... standard and secure inclu=
de
         #if expr, #elsif expr, #else #endif .... shortcut for Perl if-cons=
truct
         #c  .................................... preprocessor comment

  o  New option -I for include path

     This new option specifies a directory which is both used for #include =
and
     #sinclude directives of the new ePerl preprocessor and added to @INC
     under runtime.=20

  o  New Perl 5 interface module for ePerl parser: Parse::ePerl

     A new Perl 5 interface module named Parse::ePerl was created which mak=
es
     the ePerl parser available from within Perl scripts itself via "use
     Parse::ePerl". This module can be compiled and installed directly from
     within the distribution via
        $ perl Makefile.PL
        $ make
        $ make install
     which is possible by a top-level pseudo-MakeMaker Makefile.PL which
     handles these typical steps, i.e. the ePerl distribution now is a hybr=
id
     distribution.

  o  New ePerl emulation handler for Apache+mod_perl: Apache::ePerl

     A new ePerl handler for Apache/mod_perl was written and put into a
     Apache::ePerl module. This replaces the Apache::ePerl from Mark Imbria=
co
     and Hanno Mueller. The big difference between this one and Mark I.'s or
     Hanno M.'s versions are that that version makes use of the new
     Parse::ePerl module which itself incorporates the original ePerl parse=
r.
     So this version is more compliant to the original ePerl facility and
     emulates it more strictly.

  o  New option -h for consistency ;-)

     Just to be consequent with options a -h option was added to show the
     usage list.

  o  First attempt to write a converter from (X)SSI to ePerl

     A Perl script was added to the distribution which converts most of the
     (X)SSI directives into the corresponding or emulating ePerl directives.
     It is called shtml2phtml and can be found under contrib/ in the
     distribution.

  o  Built-in GIF images

     Again the GIF images are built right into the executable to make ePerl
     run out-of-the-box without any need for configurations. Additionally to
     the ePerl Logo (which can be access via URL /url/to/nph-eperl/logo.gif)
     there is a second image available: The POWERED-BY-EPERL image. It can =
be
     accessed via URL /url/to/nph-eperl/powered.gif.

  o  Enhanced portability

     Now the GNU autoconf-based configuration scheme determines all
     compilation parameters (CC, CFLAGS, etc.) directly from the knowledge =
of
     the installed Perl system. This way it gets compiled with the same too=
ls
     as Perl which greatly enhances the portability.

     Additionally the old egetopt function was replaced by the GNU getopt
     package which is more reliable and even works on all major Unix deriva=
tes
     (egetopt had problems under IRIX).

  o  Compiles and runs out-of-the-box on major Unix derivates.
 =20
     ePerl was already tested to compile out-of-the-box and pass the test
     suite successfully with Perl 5.003 (+EMBED) or 5.004 under FreeBSD 2.1=
=2E5,
     FreeBSD 2.2.1, BSD/OS 2.1, SunOS 4.1.3, Solaris 2.5.1, HP-UX 10.20, IR=
IX
     6.2 and Linux 2.0.18.



  Major Changes from ePerl Version 2.0 to 2.1
  =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

  License:

   o  License changed to GNU General Public License and Artistic License

      ePerl now is distributed the same way as Perl itself, i.e.  under the
      terms of the Artistic License or the GNU General Public License from =
the
      Perl 5.0 source kit. The more old and more restrictive license was
      removed.

  Runtime Behavior:

   o  Can operate in three runtime modes: FILTER, CGI and NPH-CGI.

      ePerl now can operate in three runtime modes: First a real Unix
      filtering mode (the default when not run from within a webserver
      environment), second a CGI/1.1 compliant mode which uses the CGI/1.1
      environment to find the script and generates HTTP header lines. Third=
 a
      NPH-CGI/1.1 complaint mode which is similar to the plain CGI mode, but
      here a complete HTTP response is created as a result.=20

   o  Can be used as a Shebang (#!) interpreter.

      ePerl now supports the Unix shebang technique for implicit script
      interpreter usage via the ``#!/path/to/eperl'' lines preceding the
      script. These get stripped on output.

   o  New CGI security check: Script has to end in hard-coded extensions.
   =20
      A important security check for the CGI and NPH-CGI modes were added. =
The
      script has to end in one of the following extensions which are
      hard-coded into the ePerl executable at compile time:
      .html, .phtml, .ephtml, .epl, .pl, .cgi

   o  Can switch to UID/GID of script owner.
 =20
      In CGI and NPH-CGI mode ePerl now can switch to the UID/GID of the
      script owner in a secure way when running as a setuid program. This is
      useful because it makes the owners data more secure ( aux files no
      longer need to be world-readable and temporary files and dirs no long=
er
      need to be world-writable!). ePerl tries hard to make both the setuid
      environment and this transition secure: The transition is only done w=
hen
      various security checks are passed successfully and the setuid
      environment is always discarded, even when no switching was done. For
      details in the manpage.

   o  Provides own environment variables to the script.

      ePerl now provides some useful environment variables which can be
      interpolated via $ENV{'VARIABLE'} in the script. There are variables =
for
      the size of the script, the last modification time, the script owner,
      the ePerl interpreter version and the Perl language version.

  Command Line Options:

   o  ePerl block delimiters adjustable.
  =20
      Now you can set the ePerl block delimiters on the command line. Per
      default ``<?'' and ``!>'' are set for CGI and NPH-CGI runtime modes,
      while for the FILTER runtime mode the delimiters now are ``<:'' and
      ``:>''. This way ePerl can be easily used for instance both as a
      offline HTML generation language and as a online scripting language.
      The Website META Language (WML; http://www.engelschall.com/sw/wml) is=
 an
      example of this usage.

   o  CGI and NPH-CGI modes can be tested offline.

      The runtime mode can be forced on the command line, so one now can te=
st
      the CGI and NPH-CGI modes offline from the shell.

   o  Optionally keeps the current working directory.

      ePerl usually changes the CWD under runtime to the directory where the
      executed script resides. This is useful for CGI scripts to be able to
      use relative paths when accessing aux files). For FILTER mode this is
      disabled per default. With the command line option one can force this
      for CGI and NPH-CGI modes, too.

   o  Custom environment and real Perl variables can be set.

      ePerl now provides the -E and -D command line options which can be us=
ed
      to define either environment variables ($ENV{'VARIABLE'}) or real Perl
      variables ($[main::]VARIABLE) for the script. This is a useful way of
      sending information to the script when using ePerl in FILTER mode.

   o  Enhanced I/O: Can read/write both from STDIO and external files.

      ePerl now can either read the script to execute from STDIN or external
      files. And it can write the result either to STDOUT or an explicitly
      specified file. With this ePerl can be used in all batch processing
      steps. =20

  Documentation:

   o  Unix Manpage was created.
 =20
      Now ePerl has a real Unix manpage which documents the whole
      functionality of the program: Runtime modes, Command line options,
      environment variables, etc.
 =20
  Compilation:

   o  Automatically finds latest Perl.
      Can be forced to use a particular Perl.

      When configuring the ePerl source tree via ``configure'', now the lat=
est
      Perl on your system is automatically found per default. If this is not
      what you want you can force the use of a particular Perl via configure
      option ``--with-perl=3D/path/to/perl''.

   o  Auxiliary files built-in.
 =20
      Now all auxiliary files get built-in directly into the ``eperl''
      executable, even the GIF image file which contains the ePerl logo for
      error messages. This way no filesystem paths or URLs need to be compi=
led
      into the ePerl binary.=20

   o  Contains a Test::Harness test suite.
  =20
      ePerl now contains a test suite based on the Perl module Test::Harness
      which can be run after compilation via ``make test'' from to make sure
      the compiled ePerl binary works correct.

   o  Source code was completely reorganized.
 =20
      The sources of ePerl were completely reorganized in the last months. =
Now
      prototypes are automatically generated, the library file was removed,
      the aux files are converted to C code, etc.

   o  Compiles out-of-the-box on major Unix derivates.
 =20
      ePerl now compiles out-of-the box with Perl 5.003 (EMBED) and 5.003_97
      (development version) under FreeBSD, Linux, SunOS, Solaris and HP/UX.

--m2uedje4qllpx33n
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmcT8XEACgkQvP0LAY0m
WPFMUw//fkLxo+qrBG7/R4uT6ccUl0MdLIEsYGVjtINdU+JcGVJx9L/86czy5DZn
xpRPdyDHoXlSgBVMXiGcpdWAz58y8jLreMuM8TOKT6ULyIdc9Ac7q81Gv9cM7Oaw
/pkq9Q/0cG4KP7derafy6R1czg8NY7poaTqFXm3GfIM3kR/7reOF0/aTELv5YS9G
S9rSmjCMv2psH4XbIce8vWcb1A4AgcSkWsiQ935iaxQxezFLRoXL3JFPVCqr58VE
+I8xPFay9LE+C4IR5wnzW/Ah5XfsJTjO7Ja1Yfc9pQQywMR3xIhyv6Xd02KyFbJj
3tW/9A9BmLlSfzffQKWOEuIU0vaLRLO4rYS/akawRI6rK+JF5++KhMLoM5F2Ytxg
2l2hZuOY6tvryxWaO9kzsDtLVMNhSO9AVVVzRvizheXCctDQ5mTuV4738NPUZPxN
4xgAP3XnzotIFV2R10Yv/qJ3CtT/+JJ+yfGJTQRVxHr/aLWONGznbZYTFjw6jZG8
ZXtrQGr7Z0BCb63V68CsB73OinAMfRVIrevEjDpfkORFXfkXthW8Ym7o8uZmCdtn
wXwqIKg+1qGmKeUI0PWdF491hdEb9RMiCpsMpcTq52vAPqs81tKDkHJbUHuEoe0J
I58aGTauLDF8cP4CIA8xC1Na9+8+qY4IUt0rrT6RAUz90J5txSc=
=2ePN
-----END PGP SIGNATURE-----

--m2uedje4qllpx33n--

From nabijaczleweli@nabijaczleweli.xyz Tue Sep  9 19:28:08 2025
Date: Tue, 9 Sep 2025 19:28:08 +0200
From: =?utf-8?B?0L3QsNCx?= <nabijaczleweli@nabijaczleweli.xyz>
To: ~nabijaczleweli/ossp@lists.sr.ht
Cc: Marek Chlup <xmara-deb@chlup.net>
Subject: ossp-eperl 2.2.16 released
Message-ID: <27h5qyhzrd5qvozi3zehkk66my4usl3zdqcxyvp5tbk57xog6c@tarta.nabijaczleweli.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="3ukchmhp7l7sguhi"
Content-Disposition: inline
User-Agent: NeoMutt/20231221-2-4202cf-dirty


--3ukchmhp7l7sguhi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

The release tarball, detailed changelog, and signature can be obtained from
  https://git.sr.ht/~nabijaczleweli/ossp-eperl/refs/ePerl_2_2_16
The manual is available on-line and at
  https://ra.ws.co.ls/~nabijaczleweli/ossp-eperl/blob/man/ossp-eperl.pdf

This release works around a Perl 5.40 regression(?) that,
when running with no arguments (like in CGI mode),
truncates the environment to one variable before running the script:
  https://bugs.debian.org/1114004

--3ukchmhp7l7sguhi
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmjAY6YACgkQvP0LAY0m
WPHomBAAr0t7r2LFLnriqbl9DWOOoggIZksPoyae1PZ+MiC80KP08K+xC8F7czuD
8T82A0cg51J5idFAUK7GTuQ0TljLNwK/edCpq6ObwcCnGhtjKIWAfD08oSCPsjRX
RlNkU2H+aYKxnrIzw/uElwfSgQXaUcPnWm9iHiRSCQs6axh3NLAzsygMROZ8TOg8
aXCPZfycipV8dCurIPjjbCxod7YeeGVlLv09Sw1gXW2Pa2j9gXsm5WWGgSQXH39R
BqJIGhs1bFYVZgx9H1TBrn8D7MJMxfF/w6eEH4ssY4KV5oREFznQWJ35LjXBenqf
fk8OU3wAqYzp0G2ZG0rPybWodgmJ6+lVgh3zahKPXhua6g7XNsH8CAHexZaJ9jYA
pHwiQqEAbXcEMlbimlNoXZyqV2dmOrPfdHYYhXq4gOCAfYxl1kUlSu8BUVZejQPB
8AU1k0rmcZPRmpRPbjh78fxVEICGOgTkLWDntz3hjlBrMxwD1SeLfBZsS+mTqKaI
+wN5q3EeT58XeM4SrtYtGwH0P/Wzs7lhZALnVS8yv46ZisOVlcZREV9wiq6WloNC
xMMY1A2fM1G/yUezCw6+6VMi6uIVCUPRtO9cFdz+QIhib/4dHKur4OrIdxAS58yd
qcx7kOwBFddsG/SY044VLhkeFFIZdMHmHMqpiLG/2FOF7cmul4s=
=EMSm
-----END PGP SIGNATURE-----

--3ukchmhp7l7sguhi--