munin-monitoring/munin — pull request #183 by terryburton (2014-02-12 14:12:05+00:00)
Title: Replace Date::Manip::UnixDate with Date::Parse::str2time

From http://munin-monitoring.org/ticket/1389

Terry:

munin-cgi-graph invokes UnixDate? from Date::Manip which invokes the system's date command under a shell. This makes it difficult to create a tight MAC security profile (such as AppArmor? or SELinux) since it becomes necessary to permit Munin to exec a shell, which is a gaping hole.

Christoph:

Also due to the shell execution, Date::Manip is sloooow. On my small test box, the entire Date::Manip::ParseDate? and ::UnixDate? line takes 120 ms, after replacing it with Date::Parse::str2time it is down to 3ms(sic!). Keep in mind this code is run for every graph a browser requests.

Another issue mit Date::Manip is its API change, and at some point in the future the legacy DM5 munin uses might be obsoleted anyway. It should be noted Date::Parse::str2time understands all three timestamp formats as required by RFC 2616 in "3.3.1 Full Date". So if there's really breakage due to weird date strings specified by a client, it's rather their fault. So I'm in strong favour, patch attached. The usage in master/_bin/munin-graph.in appears to be dead code by the way.