From a03bcf8f7ce1fdb4dfbd1051fa9f087c66afcfab Mon Sep 17 00:00:00 2001 From: Glenn Rice Date: Thu, 20 Aug 2026 10:38:15 -0500 Subject: [PATCH 1/2] Remove the `DynaLoader` and `IO::Handle` packages from what is shared with PG. These are dangerous to share, and expose things to problems that should not be exposed. --- conf/defaults.config | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/conf/defaults.config b/conf/defaults.config index 3f117cc694..8ecb843327 100644 --- a/conf/defaults.config +++ b/conf/defaults.config @@ -1224,7 +1224,6 @@ ${pg}{modules} = [ [qw(Encode::Encoding)], [qw(HTML::Parser)], [qw(HTML::Entities)], - [qw(DynaLoader)], [qw(Encode)], [qw(Exporter )], [qw(GD)], @@ -1261,7 +1260,7 @@ ${pg}{modules} = [ [qw(Locale::Maketext)], [qw(WeBWorK::PG::Localize)], [qw(Mojo::JSON)], - [qw(Rserve Class::Tiny IO::Handle)], + [qw(Rserve)], [qw(DragNDrop)], [qw(Types::Serialiser)], [qw(strict)], From 5525ca36cd1b41e16b825ab53514141fc7799aac Mon Sep 17 00:00:00 2001 From: Glenn Rice Date: Sat, 22 Aug 2026 21:10:41 -0500 Subject: [PATCH 2/2] Remove `HTML::Parser` from what is shared to PG. `HTML::Parser` was shared into the safe compartment, and its `parse_file` method opens and reads whatever path it is given, bypassing the permitted_read_dir restriction. Thus giving any PG problem arbitrary file read. It is not actually used by PG, and so that is removed from the modules that are shared. Note that the `HTML::Entities` package which is part of the `HTML::Parser` package on CPAN is still shared and is used. --- conf/defaults.config | 1 - 1 file changed, 1 deletion(-) diff --git a/conf/defaults.config b/conf/defaults.config index 8ecb843327..154a3581ca 100644 --- a/conf/defaults.config +++ b/conf/defaults.config @@ -1222,7 +1222,6 @@ $pg{specialPGEnvironmentVars}{problemPostamble} = { TeX => '', HTML => '' }; ${pg}{modules} = [ [qw(Encode)], [qw(Encode::Encoding)], - [qw(HTML::Parser)], [qw(HTML::Entities)], [qw(Encode)], [qw(Exporter )],