Re^3: One liner with globs on Windows to parse .srt files

[haukex]

Yeah, that's basically the same idea, but a bit longish for a one-liner, don't you think?

Dunno, seemed like the most straightforward answer to your question - just copy Win32\Autoglob.pm to wglob.pm ;-)

("'-M5;@ARGV=<*.srt>' -e'...'" actually doesn't save any characters over "-e'BEGIN{@ARGV=<*.srt>}...'")

Update: Regarding PERL5OPT, sure!

[LanX]

> '-M5;@ARGV=<*.srt>'

nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

[haukex]

nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

Note unfortunately it doesn't end up inside the BEGIN:

$ perl -MO=Deparse '-M5;print "Hello"' -e 'print "World"'
sub BEGIN {
    require 5;
    ()
}
print 'Hello';
print 'World';

The trick was added to perlsecret as the "Maori Farewell" by Discipulus after I posted about it here.

[jcb]

This is substantially the same logic quirk as the old "ShellShock" bug in bash. Both of these take an expected "data" value (although here the "data" is the name of a module to import instead of the body of a shell function) and then execute code given after that value in the same string.

The best argument against calling this a security issue is that it must be either given on the command line or in $PERL5OPT — and you have bigger problems if either of those is within an attacker's control.

[LanX]

> Note unfortunately it doesn't end up inside the BEGIN:

not with version pragmas, but anything which allows import-list will also execute code inside

d:\>perl "-MData::Dumper print ${^GLOBAL_PHASE}" -e1
START
d:\>

[LanX]

Well you know PERL5OPT doesn't allow -e and this most probably for security reasons.

But this is a backdoor to do it nevertheless.

Not sure if this must be reported.