Beefy Boxes and Bandwidth Generously Provided by pair Networks
Just another Perl shrine
 
PerlMonks  

Comment on

( #3333=superdoc: print w/replies, xml ) Need Help??
Yes, -s is very bad, but I hadn't realized just how bad until you posted this.... Among the many globals that I could tweak with -s were $< $> $) and $( which should raise a huge security flag for anyone whos read perlvar. For instance, when saved as evildashs.pl, and envoked as:

% ./evildashs.pl -\<=0 -\>=0 -\(=0 -\)=0

The following code might raise some eyebrows....

#! /usr/bin/perl -wsT use strict; print "\$) = ", $), "\n"; print "\$( = ", $(, "\n"; print "\$< = ", $<, "\n"; print "\$> = ", $>, "\n"; __END__ =head1 OUTPUT $) = 0 $( = 0 $< = 0 $> = 0
I don't think this actually gives the process any new powers, but it would allow someone to execute code that was only supposed to be invoked as root.

Oh, right. I should include the obligatory link to Getopt::Std and Getopt::Long for a much better way to handle command line options.

-Blake


In reply to Re: perl -s is evil? by blakem
in thread perl -s is evil? by malloc

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    [Corion]: marto: Naah, my module doesn't care, but the users of my module might expect some things to work in Chrome that only work in later builds (or, as seems to be the case, don't work there either ;) )
    [Corion]: But I really wonder - I can tell Chrome to go offline, but requesting pages over the network still succeeds. But if I manually click the "offline" checkbox, that's different :-/
    [LanX]: Corion can you tell WMC to check the sub version number ?
    LanX has to run

    How do I use this? | Other CB clients
    Other Users?
    Others exploiting the Monastery: (10)
    As of 2017-12-12 20:28 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?
      What programming language do you hate the most?




















      Results (336 votes). Check out past polls.

      Notices?