|P is for Practical|
Re^4: Storing state of executionby afoken (Canon)
|on Dec 11, 2015 at 18:52 UTC||Need Help??|
I prefer to have a storage format that by definition can not contain executable code instead of relying on a filter that tries to prevent malicious code execution inside a string eval. One bug in Safe and the "SafestUndumper" is no longer save, but instead happily executes malicious code.
Also, the "non-executable" formats force the programmer to use a parser. There is no way to accidentally or intentionally use a string eval on those formats.
So, who would intentionally use a string eval on untrusted code?
A little bit of bean counting:
Actually, every storage format that can contain strings can - in theory - also contain executable Perl code. But when reading back formats like XML or JSON, an explicit string eval on an extracted string is required, and that string eval is not present in the library reading the file format (or, at least, it should not be present).
Oh, and string eval means more than just eval $string:
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)