in reply to (tye)Re: Security concern with sudo and system()
in thread Security concern with sudo and system()
Under Win32, it's:
This could certainly work for all platforms. But a quick search indicates:static void get_shell(void) { dTHXo; if (!w32_perlshell_tokens) { /* we don't use COMSPEC here for two reasons: * 1. the same reason perl on UNIX doesn't use SHELL--rampant and * uncontrolled unportability of the ensuing scripts. * 2. PERL5SHELL could be set to a shell that may not be fit for * interactive use (which is what most programs look in COMSPE +C * for). */ const char* defaultshell = (IsWinNT() ? "cmd.exe /x/c" : "command.com /c"); const char *usershell = PerlEnv_getenv("PERL5SHELL"); w32_perlshell_items = tokenize(usershell ? usershell : defaultshel +l, &w32_perlshell_tokens, &w32_perlshell_vec); } }
However, it can be compiled to try looking at environment variables EMXSHELL, SHELL, COMSPEC in that order (or CMD.EXE if none of those are found), and applying the /C switch to whatever it finds; or using the contents of a variable called PL_sh_path and the -c switch. That variable is listed in a few non-OS-specific files, so it looks like this is what it is supposed to look at in all builds. That is, the configuration in embedvar or perlapi can configure the shell, without editing the deep guts.
Hmm, in other places it looks like the variable PL_sh_path contains only the directory of the shell, not the name itself, in other uses. But this OS/2 support module treats it in the same way whether it uses CMD.EXE or the contents of PL_sh_path, so it expects to find a complete executable file name there. Is this a bug?
—John
|
|---|