/ 
DBI-1.654
⭐ Starred 84 / DBD::Sponge
Security Advisories (2)
CVE-2026-108518 (2026-10-20)

DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV. The Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program.

CVE-2026-111879 (2026-10-20)

DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock. open_data creates the table's lock file and takes an exclusive flock on it for a CREATE, before the checks that can croak: a dbm_mldbm value that is not a module name, a failing tie, or a missing data file. The croak unwinds before the table object is blessed, so nothing releases the lock, and the meta data holding the open descriptor stays cached on the database handle. The dbm_mldbm and dbm_type values come from the DSN or the connect attributes, so a caller that chooses the serializer or the storage backend can trigger the failure. The flock has no timeout, so a later open of that table (even through a separate database handle) blocks for as long as the handle holding the stale lock lives, in the same process or any other.

NAME

DBD::Sponge - Create a DBI statement handle from Perl data

SYNOPSIS

my $sponge = DBI->connect("dbi:Sponge:","","",{ RaiseError => 1 });
my $sth = $sponge->prepare($statement, {
        rows => $data,
        NAME => $names,
        %attr
    }
);

DESCRIPTION

DBD::Sponge is useful for making a Perl data structure accessible through a standard DBI statement handle. This may be useful to DBD module authors who need to transform data in this way.

METHODS

connect()

my $sponge = DBI->connect("dbi:Sponge:","","",{ RaiseError => 1 });

Here's a sample syntax for creating a database handle for the Sponge driver. No username and password are needed.

prepare()

my $sth = $sponge->prepare($statement, {
        rows => $data,
        NAME => $names,
        %attr
    }
);

  • The $statement here is an arbitrary statement or name you want to provide as identity of your data. If you're using DBI::Profile it will appear in the profile data.

    Generally it's expected that you are preparing a statement handle as if a select statement happened.

  • $data is a reference to the data you are providing, given as an array of arrays.

  • $names is a reference an array of column names for the $data you are providing. The number and order should match the number and ordering of the $data columns.

  • %attr is a hash of other standard DBI attributes that you might pass to a prepare statement.

    Currently only NAME, TYPE, and PRECISION are supported. TYPE defaults to SQL_VARCHAR. PRECISION will be lazily computed if not supplied.

BUGS

Using this module to prepare INSERT-like statements is not currently documented.

AUTHOR AND COPYRIGHT

This module is Copyright (c) 2003 Tim Bunce

Documentation initially written by Mark Stosberg

The DBD::Sponge module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. In particular permission is granted to Tim Bunce for distributing this as a part of the DBI.

SEE ALSO

DBI