Re^2: How to safely define a CGI program's application base directory

[Dallaylaen]

in reply to Re: How to safely define a CGI program's application base directory
in thread How to safely define a CGI program's application base directory

BTW, on a *NIX system one can put rubbish into __FILE__ via

% ln -s myscript.pl evil-char-sequence.pl

Not as simple as 'SOMEVAR=evil-char-sequence ./myscript.pl', but still possible (but an unlikely attack vector, and not available to a remote attacker).

[Anonymous Monk]

If attacker has access to filesystem (or %ENV) the game is already over , nothing to worry about :)