spawning shell commands vs using Perl modules

qadwjoh has asked for the wisdom of the Perl Monks concerning the following question:

Hi,

I'm writing a script that needs to send an email and FTP a file and would like to know the differences between spawning a shell to carry out the necessary command and using an equivalent Perl module or program API.

Which is more secure? Are there any noticeable performance advantages or other issues? How easy is it to take advantage of the security holes? Is one method more reliable than the other?

My script needs to be secure - should I spawn sendmail and FTP commands or use Mail::Sendmail and Net::FTP?

Thanks,
Andrew

Comment on spawning shell commands vs using Perl modules

Replies are listed 'Best First'.
Re: spawning shell commands vs using Perl modules by sch (Pilgrim) on Sep 19, 2002 at 10:24 UTC
Spawning via a shell is going to have an overhead, since it will actually invoke an instance of whatever shell is configured to execute the command. This is going to use memory, process space etc which is unnecessary - in the extreme this could tie up the machine if it is configured to have a limited number of processes available to users. There can also be security issues if you try and pass arguments to anything spawned via a shell, esp if you let the users specify the arguments free text. Also, it's going to be platform dependent - by using the appropriate modules,you should be able to move the code from nix's to win32 to whatever fairly easily - this alone makes it worthwhile (imho*).	[reply]
Re: spawning shell commands vs using Perl modules by Aristotle (Chancellor) on Sep 19, 2002 at 20:05 UTC
There's no one answer to that question. I'd usually pipe to sendmail for sending mail, seeing how there is a de facto standard for what commandline parameters the binary takes regardless of nix as well as MTA flavour. With FTP clients, things are murkier. You can't rely nearly as much on it. There's also a different caveat with mail: your sendmail runs a queue, so if the destination SMTP is unreachable the mail will likely still eventually be delivered. So, the answer is it depends. There's myriad individual considerations depending on what it is you're trying to do. Makeshifts last the longest.*	[reply]
Re: spawning shell commands vs using Perl modules by Vennis (Pilgrim) on Sep 20, 2002 at 09:37 UTC
Using external programs makes you very dependable of it's parameters and features. In Perl modules updates, mostly compatibility with older versions is taken care of. For security you should choose the module i think, spawning means extra risc for bugs in another program. I think you have more control of security with a module then of an external program started with parameters. Q: Why did the Perlmonk cross the road? A: He wanted to escape the match.	[reply]