Re: Perl 5.8.6 bug in open()?

On 10/30/07, Paul Lalli <mritty@xxxxxxxxx> wrote about magic open:

It's there to make modern Perl compatable with old Perls. The only
justifiable reason I can think of to use it is to allow your user to
specify a pipe instead of a file name when you ask for a file. And if
that's something you want to do, I'd suggest you're programming a
pretty massive security hole.

No; you're letting the user do what they want. You're not opening any
security hole that wasn't opened by letting the user enter the command
on the command line in the first place. (Of course, if the command
didn't come from the user, that's another situation entirely.)

Cheers!

--Tom Phoenix
Stonehenge Perl Training
.

Relevant Pages

  • How to check if a thread waits for data at the read-end of a pipe?
    ... Win32 and in the Win32 version I need a way to check ... attach a semaphore to a named pipe and I can then use the other API ... My application acts as a GUI command line shell in this regard. ... child's STDIN, STDOUT and STDERR streams in standard documented ways. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: accomodating an unknown number of pipes in a shell program
    ... Each command is exec'd in a forked child process. ... Close all pipe file descriptors: ... the last pipe character) on to another child to repeat the process. ...
    (comp.unix.programmer)
  • Re: basic command pipe question
    ... =>to erase a bunch of files in one go. ... will execute a seperate process for *EACH* file to be deleted and would potentially overflow before the for loop even starts. ... Although, if I understand properly what's happening here, the pipe solution allows files to be erased as they are found in the filelist, while the gobbing method first requires that all files that match be found, then each command is executed one after another. ...
    (Fedora)
  • Re: Some bash questions :-)
    ... The bash command below is meant to firstly list all files with the ... Try `grep --help' for more information. ... You probably don't want to "pipe" it per se. ... of the readlink command as an argument to cd, ...
    (comp.os.linux.misc)
  • Scripts using SSH and SSH_ASKPASS
    ... To test SSH scripts you better destroy the control TTY. ... The trick is to run YOUR script on YOUR local ... As for the password relaying command: this needs not be an X command. ... # we read one line from a temporary pipe. ...
    (comp.security.ssh)