Re: regexp validation (arbitrary code execution) (regexp injection)

"Stanisław" == Stanisław Findeisen <stf@xxxxxxxxxxxxx> writes:

Stanisław> But you don't want to let them execute any code.

Unless "use re 'eval'" is in scope, /$a/ is safe even if $a came from an
untrusted source, as long as you limit the run-time to a few seconds or
so with an alarm. (Some regex can take nearly forever to fail.)

See "perldoc perlre" for more details.

--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@xxxxxxxxxxxxxx> <URL:http://www.stonehenge.com/merlyn/>
Smalltalk/Perl/Unix consulting, Technical writing, Comedy, etc. etc.
See http://methodsandmessages.posterous.com/ for Smalltalk discussion
.