Re^2: system(cp filenamewithspaces newplace/newname)

[afoken]

Double quotes on a bourne shell are subject to shell interpolation. Strange filenames will bite you:

#!/usr/bin/perl -w
use strict;
die "DON'T RUN THIS SCRIPT"; # just in case ...
my ($from,$to)=('mostly-harmless.txt','$(rm -rf /)');
system(qq[cp "$from" "$to"]);

The shell invoked (typically /bin/sh) will see the following command line:

cp "mostly-harmless.txt" "$(rm -rf /)"

Before executing cp, the shell must first evaluate "rm -rf /", as its stdout should be passed as second argument to cp.

The best way to use system is not to mess with the shell at all, i.e. to use the system LIST variant or a perl build-in. In this case, CPAN has File::Copy which handles file copying inside perl, automatically using the most efficient implementation available (system API if present, fall back to open-read-write-close), and without any quoting problems or slow sub-process invokations.

Alexander

[John M. Dlugosz]

Abigail-II has a video (presentation from a conference) where he promotes using cp not File::Copy. Personally, I think a better solution is to fix the nuances in File::Copy that he identified.