don't allow require STR within string eval to inject arbitrary code

1 files changed, 3 insertions, 9 deletions

diff --git a/lib/circular/require.pm b/lib/circular/require.pm
index 3c65846..5cc4657 100644
--- a/lib/circular/require.pm
+++ b/lib/circular/require.pm
@@ -80,10 +80,11 @@ sub _require {
     # but we're not in an eval anymore
     # fake it up so that this looks the same
     if (defined((caller(1))[6])) {
-        my $mod = _pm2mod($file);
+        require B;
+        my $str = B::perlstring($file);
         $ret = $saved_require_hook
             ? $saved_require_hook->($file)
-            : (eval "CORE::require $mod" || die $@);
+            : (eval "CORE::require($str)" || die $@);
     }
     else {
         $ret = $saved_require_hook
@@ -125,13 +126,6 @@ sub _mod2pm {
     return $mod;
 }
 
-sub _pm2mod {
-    my ($file) = @_;
-    $file =~ s+/+::+g;
-    $file =~ s+\.pm$++;
-    return $file;
-}
-
 =head1 CAVEATS
 
 This module works by overriding C<CORE::GLOBAL::require>, and so other modules