After more testing it seems the damage is done before perl evals the args, as the args include the files in that directory. I created a string in the perl script that has the files in the directory (Cwd) and once I detect that string in the args, rather that stripping that string I decided to turn the message into "I told you not to use asterisks". I'll see how that goes. Once spanked, I will just remove the dir listing from the string.
BTW They fork the perl script from the bash shell, testing for * like kennethk mentioned resulted in no asterisks ... | [reply] |
You could require them to pass the args as a single string i.e., is quoted, then check @ARGV. If it has more than 1 element, you know they did not execute the script correctly and you (the script) should then die.
That will catch most of the * shell expansion issues, but not all.
| [reply] |