From ad908b8dba6de850570dc13a3f6dd44668d481da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?K=C5=8Dan?= <koan.bot@atoomic.org>
Date: Fri, 10 Apr 2026 04:39:10 -0600
Subject: [PATCH] security: replace string eval with safe module loading

Replace `eval qq{ require $pkg }` with path-based `eval { require $file }`
in API.pm and Service.pm to eliminate string eval code injection vectors.
Replace symbolic reference string eval in DataAsYaml.pm with explicit
`no strict 'refs'` block.

Also remove defunct .travis.yml (superseded by GitHub Actions CI) and
add common patterns to .gitignore (.env*, .DS_Store, IDE directories).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .gitignore                                  |  5 ++++
 .travis.yml                                 | 32 ---------------------
 lib/OpenStack/MetaAPI/API.pm                |  4 ++-
 lib/OpenStack/MetaAPI/API/Service.pm        |  4 ++-
 lib/OpenStack/MetaAPI/Helpers/DataAsYaml.pm |  2 +-
 5 files changed, 12 insertions(+), 35 deletions(-)
 delete mode 100644 .travis.yml

diff --git a/.gitignore b/.gitignore
index e239cef..4886d27 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,8 @@ Makefile.old
 MANIFEST.bak
 OpenStack-*
 .build
+.env*
+!.env.example
+.DS_Store
+.idea/
+.vscode/
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 50dd2dd..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-language: perl
-perl:
-  # - "5.8.8"
-  # - "5.8"
-  # - "5.10"
-  # - "5.12"
-  - "5.14"
-  - "5.16"
-  - "5.18"
-  - "5.20"
-  - "5.22"
-  - "5.24"
-  - "5.26"
-  - "5.28"
-  - "blead"
-sudo: false
-matrix:
-  fast_finish: true
-  include:
-    - perl: 5.26
-      env: COVERAGE=1
-  allow_failures:
-    - perl: blead
-before_install:
-  - rm -f dist.ini # force to use Makefile.PL for faster smoke time
-  - eval $(curl https://travis-perl.github.io/init) --auto
-branches:
-  except:
-    - /^wip\//
-    - /^blocked/
-    - /^issue\d+/
-    - /^gh\d+/
diff --git a/lib/OpenStack/MetaAPI/API.pm b/lib/OpenStack/MetaAPI/API.pm
index 424df95..ba5fb41 100644
--- a/lib/OpenStack/MetaAPI/API.pm
+++ b/lib/OpenStack/MetaAPI/API.pm
@@ -15,7 +15,9 @@ sub get_service {
     my $pkg = ucfirst $name;
     $pkg = __PACKAGE__ . "::$pkg";
 
-    eval qq{ require $pkg; 1 } or die "Failed to load $pkg: $@";
+    (my $file = $pkg) =~ s{::}{/}g;
+    $file .= '.pm';
+    eval { require $file; 1 } or die "Failed to load $pkg: $@";
 
     delete $opts{name};
 
diff --git a/lib/OpenStack/MetaAPI/API/Service.pm b/lib/OpenStack/MetaAPI/API/Service.pm
index ede4321..abe091b 100644
--- a/lib/OpenStack/MetaAPI/API/Service.pm
+++ b/lib/OpenStack/MetaAPI/API/Service.pm
@@ -66,7 +66,9 @@ sub BUILD_api_specs {    # load specs
     my $pkg =
       'OpenStack::MetaAPI::API::Specs::' . ucfirst($self->name) . '::' . $v;
 
-    my $load = eval qq{ require $pkg; 1 };
+    (my $file = $pkg) =~ s{::}{/}g;
+    $file .= '.pm';
+    my $load = eval { require $file; 1 };
     if ($load) {
         return $pkg->new();
     }
diff --git a/lib/OpenStack/MetaAPI/Helpers/DataAsYaml.pm b/lib/OpenStack/MetaAPI/Helpers/DataAsYaml.pm
index bc25546..5302a8a 100644
--- a/lib/OpenStack/MetaAPI/Helpers/DataAsYaml.pm
+++ b/lib/OpenStack/MetaAPI/Helpers/DataAsYaml.pm
@@ -31,7 +31,7 @@ sub LoadDataFrom {
     my $data;
     {
         local $/;
-        my $fh = eval '\*' . $pkg . '::DATA';
+        my $fh = do { no strict 'refs'; \*{"${pkg}::DATA"} };
         $data = <$fh>;
     }