in reply to The importance of avoiding the shell

So, the moral of the story: always use the list form of system, and avoid backticks if you can. If you have to do strange things w/ redirecting output, look at IPC::Open2 and IPC::Open3 which can also take list inputs.

One trap for the unwary: system(@cmd); isn't completely reliable either, since if @cmd only has one element, it may still invoke the shell, the solution is to write system { $cmd[0] } @cmd; (documented in exec). AFAIK such a syntax is not available for IPC::Open3 and piped opens, so there it is important to make sure that @cmd always has at least two elements.

Replies are listed 'Best First'.
Re^2: The importance of avoiding the shell
by ikegami (Patriarch) on Sep 29, 2014 at 06:30 UTC

    And in Windows, even system LIST with multiple values can invoke the shell. For example, the following should fail given that dir is a shell builtin. 

    >perl -e"system 'dir', '/b'"
foo
bar

    [download]

    (Of course, that doesn't matter for the bash vulnerability.)

    system BLOCK LIST won't call the shell on any system.

[reply]
[d/l]
[select]

In Section Meditations