From e30cfd199d4cc6c7d78bce596b2cbf3c41d85f5a Mon Sep 17 00:00:00 2001 From: Glenn Rice Date: Thu, 20 Aug 2026 10:38:15 -0500 Subject: [PATCH 1/2] Remove the `DynaLoader` and `IO::Handle` packages from what is shared with PG. These are dangerous to share, and expose things to problems that should not be exposed. --- conf/defaults.config | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/conf/defaults.config b/conf/defaults.config index b2755cf22f..e3b0455d67 100644 --- a/conf/defaults.config +++ b/conf/defaults.config @@ -1181,7 +1181,6 @@ ${pg}{modules} = [ [qw(Encode::Encoding)], [qw(HTML::Parser)], [qw(HTML::Entities)], - [qw(DynaLoader)], [qw(Encode)], [qw(Exporter )], [qw(GD)], @@ -1218,7 +1217,7 @@ ${pg}{modules} = [ [qw(Locale::Maketext)], [qw(WeBWorK::PG::Localize)], [qw(Mojo::JSON)], - [qw(Rserve IO::Handle)], + [qw(Rserve)], [qw(DragNDrop)], [qw(Types::Serialiser)], [qw(strict)], From f984028e6e3842bf2e4c17066ea40035f754d68e Mon Sep 17 00:00:00 2001 From: Glenn Rice Date: Sat, 22 Aug 2026 21:10:41 -0500 Subject: [PATCH 2/2] Remove `HTML::Parser` from what is shared to PG. `HTML::Parser` was shared into the safe compartment, and its `parse_file` method opens and reads whatever path it is given, bypassing the permitted_read_dir restriction. Thus giving any PG problem arbitrary file read. It is not actually used by PG, and so that is removed from the modules that are shared. Note that the `HTML::Entities` package which is part of the `HTML::Parser` package on CPAN is still shared and is used. --- conf/defaults.config | 1 - 1 file changed, 1 deletion(-) diff --git a/conf/defaults.config b/conf/defaults.config index e3b0455d67..8085294c98 100644 --- a/conf/defaults.config +++ b/conf/defaults.config @@ -1179,7 +1179,6 @@ $pg{specialPGEnvironmentVars}{problemPostamble} = { TeX => '', HTML => '' }; ${pg}{modules} = [ [qw(Encode)], [qw(Encode::Encoding)], - [qw(HTML::Parser)], [qw(HTML::Entities)], [qw(Encode)], [qw(Exporter )],