Re^4: Is it safe to use external strings for regexes?

[dave_the_m]

> is only allowed within the scope of use re 'eval'; with "newer" Perls yes. I noticed that you changed it around 2013, and am thankful for that. *

Um no, "use re 'eval'" has always been required to allow non-literal code blocks in patterns. The big "re eval" rewrite in 5.18.0 just made it smarter, so that for example a literal (and thus safe) code block could be interpolated into a run-time regex without needing the "use re 'eval'":

use re 'eval'; # ** no longer needed from 5.18.0 onwards
$r = qr/xyz/;
/(?{ foo() })$r/;

Dave.

[LanX]

> just made it smarter ... without needing the "use re 'eval'":

hm, we seem to be talking about different things

please compare these threads

• Re: Vulnerabilities when editing untrusted code... (Komodo)
• Perl 5.17 change to use re 'eval' breaks Acme::EyeDrops
They show that concatenating literal strings to form an eval group used to work out of the box without use re 'eval' .

Both examples don't include any variables but rely on concats aka .

In detail: Some optimizer converted this

•  ''=~ ( '(?{B' . 'EGIN{print "owned"}})' )
into this at compile time
•  ''=~ '(?{BEGIN{print "owned"}})'
without complaining. Now it requires use re "eval"

[dave_the_m]

hm, we seem to be talking about different things

I thought we were talking about using strings obtained from an external source (such as a file or DB) as a regex, and whether the (?{...}) feature could be exploited in that case. The example you gave of concatting two halves of a regex still requires the code to be literal in the source (albeit split) to not need 'use re eval' in the src code, even prior to 5.18.0.

Dave.

[LanX]

As I said, I'm thankful that your change rules out

''=~ ( '(?{B' . 'EGIN{print "owned"}})' )

to happen.

Like this I have a chance to statically check for BEGIN or use re before running perl -c

(sorry eyepopslikeamosquito :)