Skip to content

fix tmpFileName($string) regression introduced in v4.71#278

Merged
leejo merged 1 commit into
leejo:masterfrom
dddonovan:fix/tmpfilename-string-arg-regression
May 5, 2026
Merged

fix tmpFileName($string) regression introduced in v4.71#278
leejo merged 1 commit into
leejo:masterfrom
dddonovan:fix/tmpfilename-string-arg-regression

Conversation

@dddonovan

@dddonovan dddonovan commented May 4, 2026

Copy link
Copy Markdown
Contributor

Summary

Since v4.71 (commit a1940af, fix for #276), tmpFileName($string) dies with Can't locate object method "filename" via package "<filename>" whenever any form param has a value exactly equal to the string passed in.

Cause

The legacy backwards-compat branch in tmpFileName iterates multi_param values, which can be plain strings. The string-equality check has no ref guard, so a plain string whose value happens to equal $filename passes through, and the next line attempts $filehandle->filename on the string and dies.

This was harmless before v4.71 because the lookup expression was $$filehandle . $filehandle (a symbolic-deref) which silently no-op'd on strings. Commit a1940af changed every site that builds the .tmpfiles key to $filehandle->filename . $filehandle for uniqueness reasons. Correct in the preferred branch where $filehandle is a blessed Fh, but breaks the legacy branch.

Fix

Add next unless ref($filehandle); above the string-equality check in the legacy branch, restoring the prior behavior of silently no-op'ing on non-Fh values.

Test

t/tmpfilename_string_arg.t adds a regression test that fails without the guard (dies in tmpFileName) and passes with it.

Environment

  • CGI.pm: 4.71
  • Perl: 5.42.0 (also reproduced on 5.40.1)
  • All existing tests in t/ continue to pass.

Commit a1940af changed the .tmpfiles hash key from $$filehandle . $filehandle
to $filehandle->filename . $filehandle for uniqueness reasons. That is
correct in the "preferred" branch where $filehandle is always a blessed Fh,
but the legacy backwards-compat branch iterates multi_param() values, which
can be plain strings for non-file params. The pre-change form silently
no-op'd via symbolic deref; the new form crashes with

  Can't locate object method "filename" via package "<value>"

whenever a non-file param value happens to equal the string passed to
tmpFileName.

Add a `next unless ref` guard above the string-equality check to skip
non-Fh values. Includes a regression test that fails without the guard
and passes with it.
@leejo
leejo merged commit 6b154d6 into leejo:master May 5, 2026
18 checks passed
@leejo

leejo commented May 5, 2026

Copy link
Copy Markdown
Owner

Thanks! v4.72 will be on its way to CPAN shortly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants