in reply to Two-arg open() considered dangerous

Um, that's why you should explicitly enter the mode yourself. 
open F, "< $f";
open F, "> $f";
open F, ">> $f";
# etc.

[download]

_____________________________________________________
Jeff[japhy]Pinyan: Perl, regex, and perl hacker.
s++=END;++y(;-P)}y js++=;shajsj<++y(p-q)}?print:??;

Replies are listed 'Best First'.
Re: Re: Two-arg open() considered dangerous
by chip (Curate) on Dec 12, 2001 at 03:56 UTC
    Japhy, you've fallen into the whitespace trap! How does "< $f" help you if $f starts with a space?

    If two-arg open() can mislead as esteemed a monk as japhy, surely we should urge less experienced monks to steer clear of it.

        -- Chip Salzenberg, Free-Floating Agent of Chaos

[reply]
[d/l]
[select]
      perlopentut covers anomolies. Anyway, that's why Perl 5.6 has the multi-arg open(). open(FH, '<', $file)

      _____________________________________________________
      Jeff[japhy]Pinyan: Perl, regex, and perl hacker.
      s++=END;++y(;-P)}y js++=;shajsj<++y(p-q)}?print:??;

[reply]
        Of course Perl 5.6 has multi-arg open ... I promoted its use in the node that started this thread!

        Sheesh, japhy, I know you're busy -- but set an example, please, and read the articles you respond to. OK?

        PS: Thanks for the perlopentut reminder.

            -- Chip Salzenberg, Free-Floating Agent of Chaos

[reply]
      I think anyone starting a filename with whitespace deserves to suffer. (Actually, I dislike any whitespace at all in a filename, but at least bash will tab-complete those cases. :)
[reply]
        I think anyone starting a filename with whitespace deserves to suffer.
        It's not a matter of suffering or not. It's a matter of being able to bypass security.

        Suppose a setuid script will only write to a file I own, and I want to attack "fred". I create "(space)fred", it checks with "-O" and notes that I own it, and then proceeds to strip the whitespace on the open. And boom, I've written into a file I don't own.

        Do not simply "ignore" special characters, saying "the user will have to suffer". As a bad guy, I could exploit your ignorance (heh), and get in. Bad design, worse results.

        -- Randal L. Schwartz, Perl hacker

[reply]
        Bash will tab complete a file beginning with a space as well, but you need to use a quote mark before the space to distinguish it from a normal space... 
        % touch " tmpfile"
% rm " [TAB-autocomplete]

        [download]

        -Blake

[reply]
[d/l]

In Section Meditations