in reply to Perl::Critic policy to catch quoted execution?
PPI does not look inside string-like things, so most Perl::Critic policies do not, either. PPIx::QuoteLike makes an attempt to sort out string contents, and it parses your string as
$ pqldump '"U GOTS $account->balance LEFTZ"' "U GOTS $account->balance LEFTZ" PPIx::QuoteLike "..." failures=0 interpolates=1 PPIx::QuoteLike::Token::String 'U GOTS ' PPIx::QuoteLike::Token::Interpolation '$account' PPIx::QuoteLike::Token::String '->balance LEFTZ'
Maybe you could look at an interpolation followed by '->' as a red flag? I have no idea what edge cases or false positives would exist. And you would need to look inside regular expressions as well.
Disclaimer: I am the author of PPIx::QuoteLike.
|
|---|