Thursday, April 9

<h1>Thursday, April  9</h1>

CGI::Fast and multi_param()
---------------------------

A little while ago, changes were made to [Perl's CGI.pm][1] because of a [class
of exploits][2] arising from calling `param()` in list context.

I had code in a wrapper for [Display][3] that called `param()` in list context
deliberately:

    # Handle input from FastCGI:
    while (my $query = CGI::Fast->new) {
      my @params = $query->param('keywords');
      print $d->display(@params);
    }

In due course, I started getting warnings about calling `param()` in list context.
They looked sort of like this:

    brennen@exuberance 18:46:13 /home/brennen/www (master) ★ perl display.fcgi 2>&1 | head -1
    CGI::param called in list context from package main line 38, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/local/share/perl/5.20.1/CGI.pm line 408.

Problematic, since a variable containing that list is _exactly what I want_. On
googling, I found that in addition to the warning, CGI.pm had been amended to
include `multi_param()` for [the cases][4] where you explicitly want a list.
Ok, cool, I'll use that.

Fast forward to just now. `display.fcgi` is blowing up on my local machine. Why?

    [Thu Apr 09 18:28:29.606663 2015] [fcgid:warn] [pid 13984:tid 140343326992128] [client 127.0.0.1:41335] mod_fcgid: stderr: Undefined subroutine CGI::Fast::multi_param

Well, ok, I upgraded Ubuntu a while back. Maybe I need to reinstall CGI::Fast
from CPAN because the Ubuntu packages aren't up to date.  So:

    $ sudo cpan -i CGI::Fast

No dice. What am I missing here?  Oh, right.  CGI::Fast inherits from CGI.pm.

    $ sudo cpan -i CGI

Golden.

Granted, I should probably stop using CGI.pm altogether.

[1]: http://search.cpan.org/~leejo/CGI-4.14/lib/CGI.pod
[2]: http://seclists.org/vulnwatch/2006/q4/6
[3]: https://github.com/brennen/display
[4]: http://search.cpan.org/~leejo/CGI-4.14/lib/CGI.pod#Fetching_the_value_or_values_of_a_single_named_parameter: