Perl Monk, Perl Meditation | |
PerlMonks |
comment on |
( [id://3333]=superdoc: print w/replies, xml ) | Need Help?? |
here a way you could go, to counter the problems listed and explained here
This will compile a regex into an anonymous sub without executing it
the re debug will emit regex-opcodes for the regexes involved to STDERR
the 1: EVAL here tells you that an EVAL was involved which you need to reject, you don't want embedded Perl code $evil_re = "(?{ BEGIN { do_evil() } })"; with Keyword::Simple disabling BEGIN,END,... etc you won't risk that the compilation of the sub inside the eval will run any code (see here) with Safe you'll be able to additionally disable a bunch of external commands. (see here) For this to work you need to spawn an external command for each regex and capture STDERR, you can use this to also limit the maximal runtime. Since your code looks a lot like a test suite, you might wanna use the TAP protocol anyway. NB: No guaranties whatsoever! HTH! :)
Cheers Rolf In reply to Re: Is it safe to use external strings for regexes?
by LanX
|
|