Re^5: One liner with globs on Windows to parse .srt files

in reply to Re^4: One liner with globs on Windows to parse .srt files
in thread One liner with globs on Windows to parse .srt files

nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

Note unfortunately it doesn't end up inside the BEGIN:

$ perl -MO=Deparse '-M5;print "Hello"' -e 'print "World"'
sub BEGIN {
    require 5;
    ()
}
print 'Hello';
print 'World';
[download]

The trick was added to perlsecret as the "Maori Farewell" by Discipulus after I posted about it here.

Comment on Re^5: One liner with globs on Windows to parse .srt files Select or Download Code

Replies are listed 'Best First'.
Re^6: One liner with globs on Windows to parse .srt files by jcb (Parson) on May 15, 2021 at 02:30 UTC
This is substantially the same logic quirk as the old "ShellShock" bug in bash. Both of these take an expected "data" value (although here the "data" is the name of a module to import instead of the body of a shell function) and then execute code given after that value in the same string. The best argument against calling this a security issue is that it must be either given on the command line or in `$PERL5OPT` — and you have bigger problems if either of those is within an attacker's control.	[reply]
Re^6: One liner with globs on Windows to parse .srt files by LanX (Sage) on May 14, 2021 at 12:32 UTC
> Note unfortunately it doesn't end up inside the BEGIN: not with version pragmas, but anything which allows import-list will also execute code inside `d:\>perl "-MData::Dumper print ${^GLOBAL_PHASE}" -e1 START d:\>` [download] Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l]
Re^7: One liner with globs on Windows to parse .srt files by haukex (Archbishop) on May 14, 2021 at 13:15 UTC
Good point, thanks! As for your other reply: PERL5OPT doesn't allow -e and this most probably for security reasons. I kind of doubt that's the case, since it does allow `-M` and `-I`, and those two can be used to execute arbitrary code from anywhere in the filesystem. I suspect the reason might be that `-enp` etc. would break things when accidentally used in a global `PERL5OPT`.	[reply] [d/l] [select]
Re^6: One liner with globs on Windows to parse .srt files (backdoor) by LanX (Sage) on May 14, 2021 at 12:13 UTC
Well you know PERL5OPT doesn't allow `-e` and this most probably for security reasons. But this is a backdoor to do it nevertheless. Not sure if this must be reported. Cheers Rolf _{(addicted to the Perl Programming Language :) Wikisyntax for the Monastery}	[reply] [d/l]

In Section Seekers of Perl Wisdom