in reply to Re^3: Stop Using Perl
in thread Stop Using Perl

Finally I saw the video (against better knowledge that it will keep me awake... ;-)

Apart from the urgent need to kick this annoying kid into a pit full of pythons (snakes not hackers¹) I was very surprised about the DBI examples...

Because quote($$;$) has obviously a signature which should force scalar context.

I coded a little example...

use strict; use warnings; package DBI; use Data::Dumper; sub quote ($$;$) { print Dumper \@_; } package CGI; sub param { return qw/a b c/; } package main; DBI->quote(CGI->param()); #DBI::quote(CGI->param());

out

$VAR1 = [ 'DBI', 'a', 'b', 'c' ];

It turns out that signatures are not effective when used as a method, b/c they can't be evaluated at compile time.

OTOH uncommenting the second direct call causes a compilation error.

The documentation of DBI is purely OOP demonstrating method calls...

... so what keeps me puzzled is why the $-signatures where ever inserted.

(It looks like it was originally not meant to be OOP and handling the problem ... but when switching to OOP this use case was forgotten.)

Does anyone have insights if this was addressed now by the maintainers?

Cheers Rolf

(addicted to the Perl Programming Language and ☆☆☆☆ :)

PS: YES I'm aware that using placeholders is the state of the art now... though I could imagine someone still using such code in production.

¹) I'm not a sadist...

Replies are listed 'Best First'.
Re^5: Stop Using Perl (DBI)
by LanX (Saint) on Jan 03, 2015 at 17:30 UTC
    Could someone please help me find products proven to be vulnerable by using DBI->quote() ?

    The only mentioned SQL injection in the talk was

    CVE-2014-9057 – MovableType SQL Injection

    But I couldn't find any details ... does anyone know the effected code?

    Cheers Rolf

    (addicted to the Perl Programming Language and ☆☆☆☆ :)