diff --git a/lib/Mango/BSON.pm b/lib/Mango/BSON.pm index e7bbcbb..a787d3e 100644 --- a/lib/Mango/BSON.pm +++ b/lib/Mango/BSON.pm @@ -216,6 +216,9 @@ sub _decode_value { my ($p, $m) = (_decode_cstring($bsonref), _decode_cstring($bsonref)); croak "invalid regex modifier(s) in 'qr/$p/$m'" if length($m) and $m !~ /^[msixpadlun]+\z/; + # prevent from injecting qr//u modifier implied by a feature enabled by + # Mojolicious 8.50 + no feature 'unicode_strings'; # escape $pat to avoid code injection return eval "qr/\$p/$m"; } diff --git a/t/bson.t b/t/bson.t index 737c1b2..944b2ab 100644 --- a/t/bson.t +++ b/t/bson.t @@ -12,6 +12,9 @@ sub TO_BSON { {something => shift->something} } package main; use Mojo::Base -strict; +# prevent from injecting qr//u modifier implied by a feature enabled by +# Mojolicious 8.50 +no feature 'unicode_strings'; no warnings 'portable'; # Mango works on 64bits systems only use Test::More;