Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number
 
PerlMonks  

Re^4: One liner with globs on Windows to parse .srt files

by LanX (Cardinal)
on May 14, 2021 at 11:42 UTC ( #11132580=note: print w/replies, xml ) Need Help??


in reply to Re^3: One liner with globs on Windows to parse .srt files
in thread One liner with globs on Windows to parse .srt files

> '-M5;@ARGV=<*.srt>'

nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

Cheers Rolf
(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery

Replies are listed 'Best First'.
Re^5: One liner with globs on Windows to parse .srt files
by haukex (Bishop) on May 14, 2021 at 11:53 UTC
    nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

    Note unfortunately it doesn't end up inside the BEGIN:

    $ perl -MO=Deparse '-M5;print "Hello"' -e 'print "World"' sub BEGIN { require 5; () } print 'Hello'; print 'World';

    The trick was added to perlsecret as the "Maori Farewell" by Discipulus after I posted about it here.

      This is substantially the same logic quirk as the old "ShellShock" bug in bash. Both of these take an expected "data" value (although here the "data" is the name of a module to import instead of the body of a shell function) and then execute code given after that value in the same string.

      The best argument against calling this a security issue is that it must be either given on the command line or in $PERL5OPT — and you have bigger problems if either of those is within an attacker's control.

      > Note unfortunately it doesn't end up inside the BEGIN:

      not with version pragmas, but anything which allows import-list will also execute code inside

      d:\>perl "-MData::Dumper print ${^GLOBAL_PHASE}" -e1 START d:\>

      Cheers Rolf
      (addicted to the Perl Programming Language :)
      Wikisyntax for the Monastery

        Good point, thanks! As for your other reply:

        PERL5OPT doesn't allow -e and this most probably for security reasons.

        I kind of doubt that's the case, since it does allow -M and -I, and those two can be used to execute arbitrary code from anywhere in the filesystem. I suspect the reason might be that -enp etc. would break things when accidentally used in a global PERL5OPT.

      Well you know PERL5OPT doesn't allow -e and this most probably for security reasons.

      But this is a backdoor to do it nevertheless.

      Not sure if this must be reported.

      Cheers Rolf
      (addicted to the Perl Programming Language :)
      Wikisyntax for the Monastery

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://11132580]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (7)
As of 2021-07-28 11:02 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found

    Notices?