Re: variable subroutine call

[meraxes]

in reply to variable subroutine call

In a word: yup.

#!/usr/bin/perl

use strict;
use warnings;

sub say_whoops {
    print "whoops\n";
}

my %functions = (
    'hi'     => sub {print "hi\n";},
    'bye'    => sub {print "bye\n";},
    'whoops' => \&say_whoops,
);


foreach my $key ( keys %functions ) {
    $functions{$key}();
}

The "hi" and "bye" are anonymous subroutines whereas whoops is executing via a reference to say_whoops(). I've stored the references in a hash simply because it's quick and easy though there are other ways. You can even pass them arguments! Take a look at perlsub for all the specifics.

HOWEVER, it's exceedingly dangerous to take arguments from STDIN to run a routine unless ya know where they're coming from. Potential security hazard. Striken as per shmem's comment. Guess I'm a worry wart really.

[shmem]

HOWEVER, it's exceedingly dangerous to take arguments from STDIN to run a routine unless ya know where they're coming from. Potential security hazard.

Care to elaborate a bit? I am running it, and it is my input, so I know where it is coming from: from me. And if I am not trustworthy for myself, who is?

What you say only applies (sometimes) when the program is running on behalf of somebody else (e.g. setuid).

[meraxes]

Sorry. I guess I should have said it can be dangerous if others have access to it. Perhaps my own prejudices. I tend to be wary of things that execute code (or in this case, arbitrary subroutines) without any checking of the input other than "does the function exist". That's all.

[shmem]

The security issue is "not validating user input" (under certain circumstances) and not "making a string into a subroutine call". If the subroutine cannot be resolved, perl will complain (i.e. die), and done. So "validating user input" doesn't apply in the OP's context.

It is just what your shell is doing, day in, day out.

[wfsp]

I am running it, and it is my input, so I know where it is coming from: from me. And if I am not trustworthy for myself, who is?

That sums up the situation nicely. Often times it is precisely because I am running it and it is my input that problems occur. I'm the last person I would trust.

I'm with meraxes on this one but of course ymmv. :-)