in reply to (tye)Re: Security concern with sudo and system()
in thread Security concern with sudo and system()

Well, other OS's don't have a /bin/sh, or a /bin/ for that matter. I thought the ENV variable was standard now, but looking at the source it seems that each platform has its own logic to find/use the shell.

Under Win32, it's:

static void get_shell(void) { dTHXo; if (!w32_perlshell_tokens) { /* we don't use COMSPEC here for two reasons: * 1. the same reason perl on UNIX doesn't use SHELL--rampant and * uncontrolled unportability of the ensuing scripts. * 2. PERL5SHELL could be set to a shell that may not be fit for * interactive use (which is what most programs look in COMSPE +C * for). */ const char* defaultshell = (IsWinNT() ? "cmd.exe /x/c" : "command.com /c"); const char *usershell = PerlEnv_getenv("PERL5SHELL"); w32_perlshell_items = tokenize(usershell ? usershell : defaultshel +l, &w32_perlshell_tokens, &w32_perlshell_vec); } }
This could certainly work for all platforms. But a quick search indicates: So, it's a real mess. Besides different specific logic for each OS or variation, there are lots of wrapping macros and levels of indirection just to make things more confusing, and inconsistant use of common code.

—John