[patch] Use FindBin to find modules with more secure @INC

latex2html-use-findbin.patch (text/plain), 1.30 KB, created by Anon Emuss on 2019-04-02 15:05:48 UTC

Several perl scripts in the config/ directory use modules such as L2hos.pm
and cfgcache.pm, assuming them to be in the current working directory.
Newer versions of perl (since 5.26) fix a security hole introduced by
implicitly searching the current directory for libraries by not
automatcially including the current directory.  Include a fix from newer
versions of latex2html by explicitly including the correct directories
relative to the path of the binary.

--- latex2html-2015/config/build.pl
+++ latex2html-2015/config/build.pl
@@ -143,6 +143,9 @@
 # --------------------------------------------------------------------------
 
 # Read in the system's configuration
+use FindBin;
+use lib "$FindBin::Bin/..";
+use lib "$FindBin::Bin";
 use cfgcache;

 my $dd = $cfg{'dd'};

--- latex2html-2015/config/config.pl
+++ latex2html-2015/config/config.pl
@@ -434,6 +434,9 @@
 use IO::File;
 use lib 'lib';
+use FindBin;
+use lib "$FindBin::Bin/..";
+use lib "$FindBin::Bin";
 use L2hos;
 
 #use diagnostics;
 use vars qw(%prefs %cfg %newcfg);

--- latex2html-2015/config/install.pl
+++ latex2html-2015/config/install.pl
@@ -181,6 +181,9 @@
 # Initialize
 # --------------------------------------------------------------------------
 
+use FindBin;
+use lib "$FindBin::Bin/..";
+use lib "$FindBin::Bin";
 use cfgcache;
 use L2hos;