New metric: check that .pm in lib/ are not executable

[dolmen]

Check the file permissions in the tarball and report if a .pm in lib/ or any .pod has the execution bit set.

Examples:

• App-Nopaste 1.003
• Spreadsheet::ParseExcel 0.65

[charsbar]

Is there any good and realistic reason for this, especially considering that files archived under Windows typically have executable bits?

[dolmen]

I do not see any good reason for .pm files having the executable bit set once they are installed on Unix(-like) platforms. Apparently the install tool (EUMM in both examples) just copies this bit from the original file.
I've not yet found if running a .pm could be exploited to bypass some security restrictions, but that does not mean that doesn't exist.

After thinking a bit more about it this is more a SiteKwalitee metric. I have no idea how this issue is spread on the CPAN and a metric would help to discover.

[dolmen]

@dolmen TODO: explore .pm files starting with a sheebang.