SID-00927: Twiki 5.0.0 Extension Installer Errors

Status:	Answered	TWiki version:	5.0.0	Perl version:	5.8.8
Category:	CategoryInstallation	Server OS:	CentOS 5.4	Last update:	12 years ago

I continue to get these errors when attempting to install any extensions. I've updated Perl, but I'm assuming that I'm missing some rights or another update (library dependency, etc...).

Here's what I get when I try to install any extensions...

Insecure dependency in open while running with -T switch at tools/extender.pl line 536.
 at tools/extender.pl line 536
	TWiki::Extender::getComponent('EditTablePlugin', 'ARRAY(0x1b49d400)', 'archive') called at tools/extender.pl line 559
	TWiki::Extender::getArchive('EditTablePlugin') called at tools/extender.pl line 947
	TWiki::Extender::_install('ARRAY(0x1c908bf0)', 'EditTablePlugin') called at tools/extender.pl line 1046
	TWiki::Extender::install('MANIFEST', 'data/TWiki/EditTablePlugin.txt,0644,\x{a}data/TWiki/VarEDITTABLE....', 'DEPENDENCIES', '') called at /home/httpd/TWiki_5.0.0/EditTablePlugin_installer line 104
	require /home/httpd/TWiki_5.0.0/EditTablePlugin_installer called at /home/httpd/TWiki_5.0.0/lib/TWiki/Configure/UIs/EXTEND.pm line 165
	eval {...} called at /home/httpd/TWiki_5.0.0/lib/TWiki/Configure/UIs/EXTEND.pm line 162
	TWiki::Configure::UIs::EXTEND::ui('TWiki::Configure::UIs::EXTEND=HASH(0x1ae6f310)') called at /home/httpd/TWiki_5.0.0/bin/configure line 708
	TWiki::_actionInstallExtension() called at /home/httpd/TWiki_5.0.0/bin/configure line 478
 at /usr/lib/perl5/5.8.8/CGI/Carp.pm line 314
	CGI::Carp::realdie('Insecure dependency in open while running with -T switch at t...') called at /usr/lib/perl5/5.8.8/CGI/Carp.pm line 385
	CGI::Carp::die('Insecure dependency in open while running with -T switch at t...') called at /home/httpd/TWiki_5.0.0/lib/TWiki/Configure/UIs/EXTEND.pm line 167
	eval {...} called at /home/httpd/TWiki_5.0.0/lib/TWiki/Configure/UIs/EXTEND.pm line 162
	TWiki::Configure::UIs::EXTEND::ui('TWiki::Configure::UIs::EXTEND=HASH(0x1ae6f310)') called at /home/httpd/TWiki_5.0.0/bin/configure line 708
	TWiki::_actionInstallExtension() called at /home/httpd/TWiki_5.0.0/bin/configure line 478

-- MikePrest - 2010-08-05

Discussion and Answer

Known issue, see TWikibug:Item6534

Workaround until fixed: Remove the -T switch from twiki/bin/configure, e.g. first line should look like this:

#!/usr/bin/perl -w

-- PeterThoeny - 2010-08-05

Could you try this patch for twiki/tools/extender.pl and let me know if this fixes the issue?

--- extender.pl   (revision 19282)
+++ extender.pl   (working copy)
@@ -50,6 +50,9 @@
 
 BEGIN {
     $installationRoot = Cwd::getcwd();
+    $installationRoot =~ /^(.*)$/;
+    $installationRoot = $1; # untaint - this is safe
+
     my $check_perl_module = sub {
         my $module = shift;
 
@@ -980,6 +983,9 @@
     my @deps;
     foreach my $row (split(/\r?\n/, $data{DEPENDENCIES})) {
         my ($module, $condition, $trigger, $type, $desc) = split(',', $row, 5);
+        $module =~ s/[^a-zA-Z0-9\:\_\-]//g;                    # allow limited chars only
+        $module = TWiki::Sandbox::untaintUnchecked( $module ); # untaint safe module name
+
         push(@deps, {
             name=>$module,
             type=>$type,

-- PeterThoeny - 2010-08-05

UPDATE: This is now fixed in TWikibug:Item6534. Action you can take:

• Workaround: Remove the T switch in the first line of file twiki/bin/configure.
• Manual fix: Please apply patch in TWikibug:Item6534 dated 2012-09-17.
• Wait for fix: The fix will be released in the upcoming TWiki-5.1.2 release (in a few weeks).

-- PeterThoeny - 2012-09-17

I'm getting this error in TWiki 6

-- Vicki Brown - 2014-01-04

-- Vicki Brown - 2014-01-04

I noticed that too, but only on certain platforms. This bug needs some TLC. Tracked at TWikibug:Item6965.

-- Peter Thoeny - 2014-01-05

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.