Re^4: 'do' command is dead? Surely not?

in reply to Re^3: 'do' command is dead? Surely not?
in thread 'do' command is dead? Surely not?

Recent versions of Perl (v5.24.1+) removed '.' from @INC, so this is probably right on the mark. If the OP is using a recent enough Perl version it will not look in the dot path unless something like this happens:

use lib '.';
[download]

Though that is subject to the challenges that the dot path has always faced. It would be better to do something like this:

use FindBin;
use lib "$FindBin::Bin/../lib"; # Or whatever is accurate for this scr
+ipt's needs.
[download]

This eliminates sensitivity to where the script was invoked from.

See also: FindBin, lib, and perl5241delta.

Dave

Comment on Re^4: 'do' command is dead? Surely not? Select or Download Code

Replies are listed 'Best First'.
Re^5: 'do' command is dead? Surely not? by haukex (Archbishop) on May 19, 2017 at 16:27 UTC
Based on this post by the OP it sounds like this is the problem! Just to add a little info: Unfortunately the 5.24.1 doc is not up on http://perldoc.perl.org yet, so here is the link to the source. It seems that do's mechanism of searching `@INC` was impacted by this change - some interesting further reading for the curious is in the P5P threads The tricky issue of do() and [perl #131069] do file: Add './' in additional cases. Update: So as far as I understand it, the issue might be improved upon in v5.26 when that gets released.	[reply] [d/l]
Re^6: 'do' command is dead? Surely not? by ACI (Acolyte) on May 19, 2017 at 17:13 UTC
At the start of your first-linked P5P thread, haukex: Which means simply saying "welp, . isn't in @INC anymore" is going to leave a vast number of broken scripts, most of them likely the ones whose users are least knowledgable about perl (do 'config.pl' is very common baby perl, I think). Fair comment! I'm likely to solve it by automating a massive search-and-replace, inserting a `'./'` before all filenames. (Might just back up first!). I think I know enough to know that the removal of `'.'` from `@INC` is best not over-ridden! Many thanks to everyone who contributed to this. You are a wise and, yes, very attractive bunch of people!	[reply] [d/l] [select]
Re^5: 'do' command is dead? Surely not? by syphilis (Archbishop) on May 20, 2017 at 09:49 UTC
Recent versions of Perl (v5.24.1+) removed '.' from @INC I knew this is coming for 5.26.0+ ... but backporting it before 5.26.0 is released seems rather extraordinary to me. For the OP's case, I think `do './test-response.pl';` [download] is sufficient. Cheers, Rob	[reply] [d/l]
Re^5: 'do' command is dead? Surely not? by ACI (Acolyte) on May 19, 2017 at 14:57 UTC
Intriguing, though a bit technical for me to grasp. I update the OS religiously, and this might have been a trigger. Currently seem to be on Perl v5.24.1.	[reply]
Re^5: 'do' command is dead? Surely not? by KurtZ (Friar) on May 19, 2017 at 14:53 UTC
Recent versions of Perl (v5.24.1+) removed '.' from @INC, Ehm , why?	[reply]
Re^6: 'do' command is dead? Surely not? by tobyink (Canon) on May 19, 2017 at 15:09 UTC
Because something as seemingly safe as `use strict` can load strict.pm from the current working directory, which might be somewhere globally writable like "/tmp/". There was apparently a real-world way of exploiting this to do nasty stuff, but the Perl development team haven't yet publicly disclosed what it is. I imagine it's an exploit in some commonly used Perl web app like cPanel or Webmin. They do plan on releasing the info eventually, once they've decided people have had enough time to move to newer Perl versions which don't have "." in @INC by default.	[reply] [d/l]
Re^7: 'do' command is dead? Surely not? by KurtZ (Friar) on May 19, 2017 at 15:53 UTC
I see, thanks. :)	[reply]
Re^7: 'do' command is dead? Surely not? by Anonymous Monk on May 19, 2017 at 17:58 UTC
That sounds false, cause . was last in @INC for a long time, so strict.pm from /tmp is not a situation that could have happened	[reply]
Re^8: 'do' command is dead? Surely not? by Corion (Patriarch) on May 19, 2017 at 18:33 UTC
Re^9: 'do' command is dead? Surely not? by Anonymous Monk on May 19, 2017 at 18:38 UTC
Some notes below your chosen depth have not been shown here
Re^6: 'do' command is dead? Surely not? by dasgar (Priest) on May 19, 2017 at 18:24 UTC
Here's one blog post that describes some background of the situation. Here's a blog post from Brian D. Foy talking about '.' being removed from @INC in 5.26. Also, it's documented in the perldelta for 5.24.1. And there's also a CVE for this issue too (CVE-2016-1238).	[reply]
Re^7: 'do' command is dead? Surely not? by KurtZ (Friar) on May 19, 2017 at 21:44 UTC
Great thanks!	[reply]

In Section Seekers of Perl Wisdom