my $cmd = "cd /home/foo/$row->{'dir'} && " .
  "./$row->{'name'}.pl >some.out 2>some.err &";

my $result = system ( $cmd );
[download]

Potential shell injection vulnerability ($row->{'dir'} and $row->{'name'}). Consider using fork and exec manually.

Rough sketch:

1. my $pid=fork() // die
2. In the main program ($pid != 0), call waitpid($pid) at some point to wait for the end of the program you have forked before. Perhaps in a SiGCHLD handler.
3. In the child process ($pid == 0), do the following:
4. chdir("/home/foo/$row->{'dir'}") or die
5. open STDOUT,'>','some.out' or die
6. open STDERR,'>','some.err' or die
7. exec("$row->{'name'}.pl") or die

Related: The problem of "the" default shell

Alexander

In my quest to make my self-contained example as brief as possible, I neglected to point out that the $row variable comes from an array under source control, and not from user input. All the user can do is press a button. (Yes, technically they could edit the page and make up their own button value, but if that value isn't in the array, nothing is executed.)

An earlier version of my code did use fork/exec, but it didn't work as expected under Mojolicious (Mojo waited for the child to finish), so I moved on to other approaches.

Alex / talexb / Toronto

Thanks PJ. We owe you so much. Groklaw -- RIP -- 2003 to 2013.

Proc::Background