Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister

Re^2: Bug in perl command line processing?

by demerphq (Chancellor)
on May 22, 2012 at 21:14 UTC ( #971878=note: print w/replies, xml ) Need Help??

in reply to Re: Bug in perl command line processing?
in thread Bug in perl command line processing?

The -e1 is unnecessary.

$ perl -MO=Deparse -i'foo e eval "warn q[bar]";' BEGIN { $^I = "foo"; } eval 'warn q[bar]'; -e syntax OK

I vote bug.


Replies are listed 'Best First'.
Re^3: Bug in perl command line processing?
by davido (Archbishop) on May 22, 2012 at 21:34 UTC

    The -e1 is unnecessary.

    That seems to be because perl sees the 'e' in 'foo e eval...' as an -e command line switch. Change it to something else besides 'e' and the behavior changes.

    It sort of feels like the same sort of exploit one should worry about when using the two-arg open unsafely, passing user data to a database without placeholders, or instantiating user data as variable names.


      Yes, but to me that is THE bug.



        BTW: It doesn't seem to propagate into full-fledged scripts like this:

        #!/usr/bin/perl -i'foo e eval "warn q[bar]" ' 1;

        From what I can tell, -i has to actually appear on the command-line, which hopefully self-limits its significance as a tool for exploit.


Re^3: Bug in perl command line processing?
by sauoq (Abbot) on May 22, 2012 at 21:42 UTC
    The -e1 is unnecessary.

    Yes, sorry. I should have explained my intent... I was showing that by adding the ';' to the OP's you could include -e1 without an error.

    "My two cents aren't worth a dime.";

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://971878]
[Corion]: Of course, the query performance for "all items on page 10" is likely worse than rank() between 100 and 109 , but if that means I can write 15 lines of SQL instead of needing to think about how to partition things and how to encode the page size...
[Corion]: ... that would be nice. But alas, I'm currently tied to SQLite as minimum implementation, and it doesn't implement window functions :-(
[Corion]: And I'm not aware of any other serverless SQL implementation that even reaches the capability of SQLite, not to mention surpasses it

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (10)
As of 2018-03-22 12:21 GMT
Find Nodes?
    Voting Booth?
    When I think of a mole I think of:

    Results (274 votes). Check out past polls.