Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Re^2: The importance of avoiding the shell

by jhourcle (Prior)
on Sep 25, 2014 at 11:53 UTC ( #1101961=note: print w/replies, xml ) Need Help??


in reply to Re: The importance of avoiding the shell
in thread The importance of avoiding the shell

Notice how in my first test, I called sh? Some OSes (these examples were from a MacOS X box) use bash for sh.

You should run the tests and check if you're vulnerable. Don't just think 'oh, it won't happen to me, I'm using ksh', as perl may still send to a vulnerable sh:

sh-3.2$ ksh $ set -o emacs $ env x='() { :;}; echo vulnerable' ksh -c "echo this is a test" this is a test $ env x='() { :;}; echo vulnerable' perl -e 'system "echo test;"' vulnerable test

Replies are listed 'Best First'.
Re^3: The importance of avoiding the shell
by mr_mischief (Monsignor) on Sep 26, 2014 at 13:51 UTC

    This is why Corion, whom I assure you is not an idiot, mentioned the concept of the default shell. Please do read what you are responding to before repeating what was just said in a haughty way.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1101961]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others chanting in the Monastery: (5)
As of 2019-04-20 02:35 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    I am most likely to install a new module from CPAN if:
















    Results (108 votes). Check out past polls.

    Notices?
    • (Sep 10, 2018 at 22:53 UTC) Welcome new users!