fix: code injection vulnerability in digest-bench

[toddr-bot]

Summary

SECURITY — digest-bench uses eval "require $mod" which allows arbitrary Perl code execution when the module name argument is attacker-controlled. This may warrant a vulnerability report.

• Replace eval "require $mod" with safe bare require (convert :: to /, same pattern as Digest.pm)
• Declare my $a instead of clobbering the special $a sort variable

Why

Line 8 of digest-bench used eval "require $mod" where $mod comes directly from @ARGV. An attacker (or careless user) could pass "Digest::MD5; system('rm -rf /')" and the injected code would execute inside the eval. The safe pattern used in Digest.pm itself (lines 42-47) converts :: to / and uses bare require, which only loads files and cannot execute arbitrary code.

How

Two-commit approach per security flagging conventions:

1. First commit adds a PoC test that creates a canary file via injection — proves the vulnerability is real
2. Second commit applies the fix — the test then passes

Testing

• PoC test confirms injection no longer works (canary file is not created)
• digest-bench Digest::MD5 still produces correct benchmark output
• Full test suite passes: 4 files, 24 tests, all green

---

🤖 Generated with Claude Code