Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl Monk, Perl Meditation
 
PerlMonks  

Re: UGU file rename script (GOLF?)

by myocom (Deacon)
on Jul 20, 2001 at 00:08 UTC ( #98219=note: print w/replies, xml ) Need Help??


in reply to UGU file rename script (GOLF?)

While you're golfing, you might want to add the tiniest bit of security, for heaven's sake. String eval is a potentially very bad thing.

rename '`rm -rf /`' foo

Replies are listed 'Best First'.
Re: Re: UGU file rename script (GOLF?)
by chipmunk (Parson) on Jul 20, 2001 at 01:37 UTC
    `rm -rf /` in an eval would execute rm with the user's own permissions. If the user can run rename '`rm -rf /`' on the command line, they could just as easily run rm -rf / directly.

    In other words, as long as you don't do something foolish like make the rename script setuid or create a web interface to it, I would argue that this script has no inherent security issues.

      I understand that it would execute rm with the user's own permissions. And that may not be a problem for this particular application (though I would never deploy it on *my* network).

      I'm more concerned that this sort of code will get passed on to a different application (cargo-cult style), where security *does* matter. To my thinking, there should at least be a comment about security in there by the eval.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://98219]
help
Chatterbox?
[Discipulus]: [OT] if i have an svg image (a map of italian provinces) like this one in which way i need to interact with it to have a geochart?
[Corion]: I haven't found a good way to plot stuff into country maps... Maybe one of the demos of D3.js has something usable?
[Discipulus]: i need to use css to get and colorize various different IDs?
[Corion]: I haven't used it, but http://datamaps. github.io/ looks promising
[Discipulus]: thanks.. a more perlish solution?

How do I use this? | Other CB clients
Other Users?
Others examining the Monastery: (14)
As of 2017-03-23 09:23 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Should Pluto Get Its Planethood Back?



    Results (285 votes). Check out past polls.