Extended CVE-2024-10224 patch and fixed ptests in perl-Module-ScanDeps. (#11218)

Author: PawelWMS

SPECS/perl-Module-ScanDeps/CVE-2024-10224.patch

@@ -243,3 +243,39 @@ index 7bc9662..dd79c65 100644
          # e.g. for autosplit .ix and .al files. In the latter case,
          # the key may also start with "./" if found via a relative path in @INC.
          $key =~ s|\\|/|g;
+
+
+From 49468814a24221affe113664899be21aef60e846 Mon Sep 17 00:00:00 2001
+From: rschupp <roderich.schupp@gmail.com>
+Date: Fri, 8 Nov 2024 19:17:30 +0100
+Subject: [PATCH] fix parsing of "use if ..."
+
+Fixes errors in PAR::Packer test t/90-rt59710.t
+---
+ lib/Module/ScanDeps.pm | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/lib/Module/ScanDeps.pm b/lib/Module/ScanDeps.pm
+index f911440..71d8b75 100644
+--- a/lib/Module/ScanDeps.pm
++++ b/lib/Module/ScanDeps.pm
+@@ -925,7 +925,7 @@ sub scan_line {
+           next CHUNK;
+         }
+ 
+-        if (my ($pragma, $args) = /^use \s+ (autouse|if) \s+ (.+)/x)
++        if (my ($pragma, $args) = /^(?:use|no) \s+ (autouse|if) \s+ (.+)/x)
+         {
+             # NOTE: There are different ways the MODULE may
+             # be specified for the "autouse" and "if" pragmas, e.g.
+@@ -938,7 +938,9 @@ sub scan_line {
+             else {
+                 # The syntax of the "if" pragma is
+                 #   use if COND, MODULE => ARGUMENTS
+-                (undef, $module) = _parse_module_list($args);
++                # NOTE: This works only for simple conditions.
++                $args =~ s/.*? (?:,|=>) \s*//x;
++                ($module) = _parse_module_list($args);
+             }
+             $found{_mod2pm($pragma)}++;
+             $found{_mod2pm($module)}++ if $module;

SPECS/perl-Module-ScanDeps/perl-Module-ScanDeps.spec

@@ -2,7 +2,7 @@
 Summary:        Recursively scan Perl code for dependencies
 Name:           perl-Module-ScanDeps
 Version:        1.35
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        GPL+ or Artistic
 Group:          Development/Libraries
 Source0:        https://cpan.metacpan.org/authors/id/R/RS/RSCHUPP/Module-ScanDeps-%{version}.tar.gz
@@ -15,10 +15,14 @@ BuildRequires:  perl >= 5.28.0
 BuildRequires:  perl(ExtUtils::MakeMaker)
 BuildRequires:  perl-generators
 %if 0%{?with_check}
+BuildRequires:  perl(AutoLoader)
+BuildRequires:  perl(blib)
 BuildRequires:  perl(CPAN)
 BuildRequires:  perl(CPAN::Meta)
 BuildRequires:  perl(FindBin)
+BuildRequires:  perl(Test)
 BuildRequires:  perl(Test::More)
+BuildRequires:  perl(Test::Pod)
 %endif
 
 Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
@@ -55,6 +59,7 @@ find %{buildroot} -type f -name .packlist -exec rm -f {} +
 export PERL_MM_USE_DEFAULT=1
 cpan local::lib
 cpan Test::Requires
+cpan IPC::Run3
 make %{?_smp_mflags} test
 
 %files
@@ -65,13 +70,16 @@ make %{?_smp_mflags} test
 %{_mandir}/man3/*
 
 %changelog
+* Mon Nov 25 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.35-3
+- Fixing perl-Module-ScanDeps tests.
+
 * Fri Nov 15 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.35-2
 - Patched CVE-2024-10224.
 
 * Mon Dec 18 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 1.35-1
 - Auto-upgrade to 1.35 - Azure Linux 3.0 - package upgrades
 
-* Tue Aug 23 2020 Muhammad Falak <mwani@microsoft.com> - 1.31-2
+* Tue Aug 23 2022 Muhammad Falak <mwani@microsoft.com> - 1.31-2
 - Add BR on `perl-{(CPAN::*),(FindBin),(Test::More)}` to enable ptest
 
 * Fri Apr 22 2022 Mateusz Malisz <mamalisz@microsoft.com> - 1.31-1