TODO

This is a document listing items to research.

Included external binary libraries

The following distributions have Windows/DOS .dll and .exe files:

git ls-files | grep '.\(dll\|exe\)$' | sed 's|distros/./\([^/]\+\)/.\+|\1|' | sort | uniq > /tmp/dll-distros

Acme-MITHALDU-BleedingOpenGL
Album
Alien-Base-ModuleBuild
Alien-BatToExeConverter
Alien-Build
Alien-MeCab
Alien-Win32-LZMA
Alien-wxWidgets
Apache2-AutoIndex-XSLT
App-dumpbin
App-SweeperBot
App-whichdll
CAD-ProEngineer
Cisco-IPPhone
Clang-CastXML
Config-LotusNotes
Crypt-MatrixSSL
Data-ParseBinary
Device-LabJack
Device-ParallelPort-drv-win32
Device-Velleman-K8055
dmake
eicndhcpd_v111_src
ExtUtils-Depends
FFI-CheckLib
File-Which
HoneyClient-Agent
HoneyClient-DB
HoneyClient-Manager
HoneyClient-Util
Image-ExifTool
lanman
LEOCHARRE-Dev
Lingua-EN-SENNA
Mecom
Net-FullAuto
Notes
OpenGL
OpenGL-GLUT
PeopleSoft
Perl-Dist-Strawberry
Perl-Dist-WiX
perl_mlb
Portable
Portable-Dist
Prima-prigraph-win32
Run-Parts
SOM
Sys-GNU-ldconfig
Tie-LevelDB
tinyperl
Win32-API
Win32-Excel-Refresh
Win32-Exe
Win32-FTDI-FTD2XX
Win32-GUI
Win32-GUI-Scintilla
Win32-GuiTest
Win32-IEAutomation
Win32-PEFile
Win32-PerfMon
Win32-PerlExe-Env
Win32-Resources
Win32-ServiceManager
Win32-SqlServer
Win32-TSA-Notify
Win32-Vcpkg
Win32-Watir
XS-libdwarf

Wx-PdfDocument

This distribution also includes embedded binaries, see https://metacpan.org/release/MDOOTSON/Wx-PdfDocument-0.21/source/MANIFEST

mswlibs/builtin/x64/libwxexpat.a
mswlibs/builtin/x64/libwxjpeg.a
mswlibs/builtin/x64/libwxpng.a
mswlibs/builtin/x64/libwxregex.a
mswlibs/builtin/x64/libwxregexu.a
mswlibs/builtin/x64/libwxtiff.a
mswlibs/builtin/x64/libwxzlib.a
mswlibs/builtin/x64/wxexpat.lib
mswlibs/builtin/x64/wxjpeg.lib
mswlibs/builtin/x64/wxpng.lib
mswlibs/builtin/x64/wxregex.lib
mswlibs/builtin/x64/wxregexu.lib
mswlibs/builtin/x64/wxtiff.lib
mswlibs/builtin/x64/wxzlib.lib
mswlibs/builtin/x86/libwxexpat.a
mswlibs/builtin/x86/libwxjpeg.a
mswlibs/builtin/x86/libwxpng.a
mswlibs/builtin/x86/libwxregex.a
mswlibs/builtin/x86/libwxregexu.a
mswlibs/builtin/x86/libwxtiff.a
mswlibs/builtin/x86/libwxzlib.a
mswlibs/builtin/x86/wxexpat.lib
mswlibs/builtin/x86/wxjpeg.lib
mswlibs/builtin/x86/wxpng.lib
mswlibs/builtin/x86/wxregex.lib
mswlibs/builtin/x86/wxregexu.lib
mswlibs/builtin/x86/wxtiff.lib
mswlibs/builtin/x86/wxzlib.lib

See #60.

Included Java .jar and .class files

uplug-main seems to have .jar files included.

git ls-files | grep '.\(jar\|class\)$' | sed 's|distros/./\([^/]\+\)/.\+|\1|' | sort | uniq > /tmp/java-distros

The following list of distributions with Java .jar or .class files:

Acme-CPANModulesBundle-Import-MojoliciousAdvent-2017
Alien-Ditaa
Alien-InteractiveBrokers
Alien-Jerl
Alien-Saxon
Alien-SeleniumRC
Apache2-WebApp-Toolkit
App-Basis-ConvertText2
Archive-Extract
Archive-Probe
arXiv
Bio_AssemblyImprovement
Couchbase
Couchbase-Client
DateTime-TimeZone-HPUX
Date-Tolkien-Shire-Data
Db-DFC
DBD-JDBC
Dist-Zilla-Plugin-Web
dotReader
EBook-EPUB-Check
FreeWRL
hyperic-sigar
IBM-LoadLeveler
Image-WebP
Inline-Java
Java
Java-2Perl6API
Java-Build
Java-JVM-Classfile
Java-SJ
JDBC
Jemplate
jp_beta
Lingua-StanfordCoreNLP
Maplat
Music-NeoRiemannianTonnetz
Net-RabbitMQ-Java
NLP-Service
osgish
Package-Tent
PerlPoint-Converters
TBX-Checker
Text-ClearSilver
Text-PDF2XML
UML-Sequence
uplug-main
Wasm-Wasm3
WWW-HtmlUnit
XML-Filter-Essex
XML-Jing
XML-Schema

Included JavaScript

There are many modules that include jQuery and other JavaScript libraries as part of the distribution.

The following list of distributions have JavaScript, generated from

git ls-files | grep '.js$' | sed 's|distros/./\([^/]\+\)/.\+|\1|' | sort | uniq

Included external libraries

picohttpparser

Investigate HTTP::Parser::XS and Gazelle using picohttpparser #95

libjpeg

matio

PDF-IO-Matlab uses matio 1.5.0 which has at least one vulnerability, see https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=matio (was #47)

libgit2

I've researched some of the version history for Git-Raw's use of libgit2, see

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libgit2 https://metacpan.org/dist/Git-Raw/changes But we need to correlate git commit ids in libgit2 with versions. I've assumed the changes related to the nearest tag but these may not be correct.

Also note that there are additional deps included https://metacpan.org/release/JACQUESG/Git-Raw-0.88/source/deps/libgit2/deps

This includes one issue for zlib http-parser https://github.com/nodejs/http-parser/ ntlm-client TBD pcre TBD winhtt[ TBD I've created a ticket https://github.com/jacquesg/p5-Git-Raw/issues/223

These deps are part of libgit2. I've sent a separate email to that project regarding zlib.

libpcre and libpcre2

MarpaX-ELSIF includes pcre2, among other libraries. Do any others?
libgit2 has pcre as an internal dependency
Perl6-Pugs
re-engine-RE2 may have pcre

libucl

Config-UCL has libucl-0.8.1, but it appears that libucl is updated more recently but the ChangeLog file is not, which means that it might be a newer version. (The configure.ac in the git repo calls the version "0.8.2".)

libucl also has some fixed security issues that are not CVEs:

But it does not look like the embedded version of libucl contains the most recent security fix.

I have created a ticket for Config-URL https://rt.cpan.org/Ticket/Display.html?id=143727

lua

Some modules amay include a version of lua.

openssl

Socket-Class includes openssl. Do any others?

Cryptography

We should look over Changes and any open issues for cryptography-related modules, including modules in the Digest or Crypt namespaces.

Also see

File-KeePass
File-KDBX
Net-SSH-Perl
Net-SSLeay

Provide feedback

Saved searches

Use saved searches to filter your results more quickly