fixed possible vulnerability loading help files

docs/changelog/7.x.x.txt

@@ -2,6 +2,7 @@
  - webgui.org homepage gives 404  (#11778)
  - fixed #11779: SQLReport can run arbitrary queries
  - fixed possible vulnerability loading template parser
+ - fixed possible vulnerability loading help files
 
 7.9.11
  - fixed #11755: New cart does not update shipping methods correctly

lib/WebGUI/Operation/Help.pm

@@ -41,18 +41,16 @@ been already and logs errors during the load.
 sub _loadHelp {
 	my $session = shift;
 	my $helpPackage = shift;
+        eval { WebGUI::Pluggable::load( $helpPackage ); };
+	if ($@) {
+		$session->errorHandler->error("Help failed to compile: $helpPackage. ".$@);
+		return {};
+	}
 	if (defined *{"$helpPackage\::HELP"}) {  ##Symbol table lookup
 		our $table;
 		*table = *{"$helpPackage\::HELP"};  ##Create alias into symbol table
 		return $table;  ##return whole hashref
 	}
-	my $load = sprintf 'use %-s; $%-s::HELP', $helpPackage, $helpPackage;
-	my $help = eval($load);
-	if ($@) {
-		$session->errorHandler->error("Help failed to compile: $helpPackage. ".$@);
-		return {};
-	}
-	return $help;
 }
 
 #-------------------------------------------------------------------

t/Help/compiled.t

@@ -15,13 +15,14 @@ use lib "$FindBin::Bin/../lib";
 use WebGUI::Test;
 use WebGUI::Session;
 use WebGUI::Operation::Help;
+use Test::More;
+use Test::Exception;
 
 #The goal of this test is to verify that all entries in the lib/WebGUI/Help
 #directory compile.  This test is necessary because WebGUI::Operation::Help
 #will return an empty hash if it won't compile, and the help will simply
 #disappear.
 
-use Test::More;
 my $numTests = 0;
 
 my $session = WebGUI::Test->session;
@@ -30,10 +31,18 @@ my @helpFileSet = WebGUI::Operation::Help::_getHelpFilesList($session);
 
 $numTests = scalar @helpFileSet; #One for each help compile
 
-plan tests => $numTests;
+plan tests => $numTests + 2;
 
 foreach my $helpSet (@helpFileSet) {
 	my $helpName = $helpSet->[1];
 	my $help = WebGUI::Operation::Help::_load($session, $helpName);
 	ok(keys %{ $help }, "$helpName compiled");
 }
+
+#----------------------------------------------------------------------------
+# Test invalid help files
+WebGUI::Test->interceptLogging;
+lives_ok { WebGUI::Operation::Help::_load( $session, '::HI::' ) } "invalid help module doesnt die";
+like( $WebGUI::Test::logger_error, qr/^Help failed to compile/, 'invalid help module errored' );
+
+WebGUI::Test->restoreLogging;