/ 
libwww-perl-6.01
⭐ Starred 204 / LWP::Debug
Security Advisories (2)
CPANSA-libwww-perl-2017-01 (2017-11-06)

LWP::Protocol::file can open existent file from file:// scheme. However, current version of LWP uses open FILEHANDLE,EXPR and it has ability to execute arbitrary command

CVE-2026-8368 (2026-05-12)

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.

NAME

LWP::Debug - deprecated

DESCRIPTION

LWP::Debug used to provide tracing facilities, but these are not used by LWP any more. The code in this module is kept around (undocumented) so that 3rd party code that happen to use the old interfaces continue to run.

One useful feature that LWP::Debug provided (in an imprecise and troublesome way) was network traffic monitoring. The following section provide some hints about recommened replacements.

Network traffic monitoring

The best way to monitor the network traffic that LWP generates is to use an external TCP monitoring program. The Wireshark program (http://www.wireshark.org/) is higly recommended for this.

Another approach it to use a debugging HTTP proxy server and make LWP direct all its traffic via this one. Call $ua->proxy to set it up and then just use LWP as before.

For less precise monitoring needs just setting up a few simple handlers might do. The following example sets up handlers to dump the request and response objects that pass through LWP:

use LWP::UserAgent;
$ua = LWP::UserAgent->new;
$ua->default_header('Accept-Encoding' => scalar HTTP::Message::decodable());

$ua->add_handler("request_send",  sub { shift->dump; return });
$ua->add_handler("response_done", sub { shift->dump; return });

$ua->get("http://www.example.com");

SEE ALSO

LWP::UserAgent