Bug 7591

Created attachment 5577 [details]
Patch to reversethe fast untaint in Util.pm

3.4 fails passing tests for me with the idn_dots.t 

If you modify the t/idn_dots.t to print the uri list from the generated message in the test, it fails in 3.4 but passes in Trunk and in the 3.4.1 release.  

When it prints the URI list for me, it's missing the utf1.example.com item.

Interestingly, it passes with 3 or less URIs and fails with 4 or more.

Giovanni Becchis, Bill Cole and myself have recreated it under different scenarios but the key point seems to be Centos/Redhat

 - Confirmed problems with Centos/RHEL including:
     Centos 7.4.1708 and stock perl 5.16.3 FAILS subtest 4
     Centos 7.5.1804  with stock 5.16.3 also fails
 - Centos 7.5.1804 with custom compiled perl 5.26.2 does not fail.
 - Works on other things such as Ubuntu & MacOS 10.6.8 and 10.11.6 with perl 5.26.2
 - Running the test multiple times sometimes gives different results.


Steps to Recreate:

On a CentOS 7 box
svn checkout https://svn.apache.org/repos/asf/spamassassin/branches/3.4
cd 3.4
perl Makefile.PL
make
prove -v t/idn_dots.t


Other Notes:

- Adding "use utf8;" to t/idn_dots.t fixes the problem but it is not clear why.  We consider this hiding the issue.

- Trunk has the issue but it is more hidden.  Bill Cole will make a test for it.

- Adding more text to the t/idn_dots.t files (my $string = "http://utf$i" . $delim . "example" . $delim . "com";) to (my $string = "an url: http://utf$i" . $delim . "example" . $delim . "com";) makes things fail with less URLs.

- When using the perl debugger on seems to fix it


Solution #1:
  - reverting the fast untaint patch work in util.pm on bug 7496 appears to work
  - Confirm after the hidden test case for trunk is completed by Bill

Solution #2:
  - Also using a newer perl appears to work.


-- NOTE: Custom Perl Notes

rm -f config.sh Policy.sh
sh Configure -des -Dprefix=~/usr/local/perl-5.26 -Dusedl -Acflags='-fPID -DPIC -m64'
make -j4
make install
rm ~/.cpan -rf
~/usr/local/perl-5.26/bin/cpan install HTML::Parser Net::DNS NetAddr::IP

~/usr/local/perl-5.26/bin/perl Makefile.PL
svn checkout https://svn.apache.org/repos/asf/spamassassin/branches/3.4
cd 3.4
~/usr/local/perl-5.26/bin/perl Makefile.PL
make
~/usr/local/perl-5.26/bin/prove -v t/idn_dots.t