Bug in perl command line processing?

[EvanCarroll]

I was playing around with some bugged command line processing by perl, and I discovered that I could execute code with -i. The argument -i is supposed to just turn on in place editing.

An example is provided: perl -i'foo e eval "warn q[bar]" '

I'm still not exactly sure how it works. Are there any security implications in this?

[sauoq]

$ perl -MO=Deparse -i'foo e eval "warn q[bar]";' -e1
BEGIN { $^I = "foo"; }
eval 'warn q[bar]';
'???';
-e syntax OK

[demerphq]

The -e1 is unnecessary.

$ perl -MO=Deparse -i'foo e eval "warn q[bar]";'
BEGIN { $^I = "foo"; }
eval 'warn q[bar]';
-e syntax OK

I vote bug.

[davido]

The -e1 is unnecessary.

That seems to be because perl sees the 'e' in 'foo e eval...' as an -e command line switch. Change it to something else besides 'e' and the behavior changes.

It sort of feels like the same sort of exploit one should worry about when using the two-arg open unsafely, passing user data to a database without placeholders, or instantiating user data as variable names.

[sauoq]

The -e1 is unnecessary.

Yes, sorry. I should have explained my intent... I was showing that by adding the ';' to the OP's you could include -e1 without an error.

[EvanCarroll]

Right that is obviously what is doing, but is that safe for Perl and not the shell to break apart an argument on spaces? This seems dangerous. You now need to sanitize your backup-character-extensions for space characters because perl may otherwise execute it as code?

[sauoq]

I think you found a real bug. And, sure, there are security implications. Theoretically, anyway. There are probably not that many places where this poses a real security threat. There's more potential for it to cause things to break and leave people scratching their heads though.

[Anonymous Monk]

https://rt.perl.org/rt3/Ticket/Display.html?id=113046

[Anonymous Monk]

Looks like this has always been the case, with win32 perl-5.6.1

C:\> perl -MData::Dump -e " dd\@ARGV " perl -i".bak h "
["perl", "-i.bak h "]

C:\> perl -i".bak h "

Usage: *snip*

You might expect this to turn up some bug reports but it doesn't, see https://rt.perl.org/rt3/Public/Search/Simple.html?q=whitespace+-i

[Anonymous Monk]

See also How Command Line Parameters Are Parsed and Behind the GUI lives the Shell

[sauoq]

This completely misses the point.

[Anonymous Monk]

This completely misses the point.

Not it doesn't , the point of a "SEE ALSO" section is to "SEE ALSO"

The OP doesn't even specify what shell he is dealing with, and this is shell quoting territory