Re: MP1 Security issue

["Alex Solovey" <suppressed>]

On 3/23/07, Randal L. Schwartz <suppressed> wrote:
> You're correct.  It has been fixed in Apache::Registry for MP1.  I'm sorry I
> overlooked that last night.  For mp1, it affects only users of
> Apache::PerlRun.
>
> However, for mp2, since the listed modules all use ModPerl::RegistryCooker,
> and the problem is in there, my list is still accurate.

Not quite. In mp2, the problem is in RegistryCooker.pm, sub
namespace_from_uri which is not called from anywhere in default setup,
including PerlRun and Registry _unless_ default behaviour is overriden
but something like

*ModPerl::MyRegistry::namespace_from =
   \&ModPerl::RegistryCooker::namespace_from_uri;

This may be present in some users code though, especially if it is
migrated to mp2 from mp1 where uri-based namespaces were default, but
I do not think it is common.

--  Alex