It's not just one-liners, and it's not just root. Any script that doesn't untaint ARGV is vulnerable. Partly, that vulnerability is incidental, given that once someone has broken into an account it is a lot easier for them to do damage directly, rather than wasting time attacking some Perl script.

Very few Perl books talk about ARGV being a vulnerability. Or if they do, it's in passing in one part of the book, with examples in other parts ignoring the hazard.

Any script that doesn't untaint ARGV is vulnerable.

Which is this thread's lesson :)

But I still think magic ARGV should not use two-arg open.

Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }

I'm a little suprised people are still being suprised by the magic of the open call.

I'm not surprised by the open call. I'm surprised that Perl uses this way to open files with magic ARGV. Three argument open would have been a lot safer.

I'm very sure I'm not the only one who forgot that magic ARGV uses normal two-arg open internally. The number of exploitable scripts made by my customers and myself proves that most people are unaware of the security problems or chose to simply ignore them. I found 15 so far.

If you're worried, turn on taint.

Thanks. Even though I hate Perl's tainting mechanism, I'll use it here. It still cannot really fix the problem, since scripts will now die if they encounter an invalid file.

BTW, who runs oneliners as root? (i'd consider that a bug)

Everyone who needs a script to run as root runs scripts as root.

Users can't do everything root can, and sometimes you need to be root to do what you want to do.
Not everything can be done by a user, some things need to be done by root.

And some of those things are made by me, and those things made by me are written in Perl.
Perl is a powerful language that lets me do those things in simple one-liners, so I do do that with simple one-liners.

The one-liners run as root because they need to do things that only root can do.
The one-liners couldn't do what they need to do if they were not run as root.
And THAT would be a bug.

Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }

I'm surprised that Perl uses this way to open files with magic ARGV.

Why? This feature existed long before open had 3 arguments, why would it suddenly change.

It still cannot really fix the problem, since scripts will now die if they encounter an invalid file

There is no problem to fix. Sanitize your @ARGV if you insist on magic.

MJD says you can't just make shit up and expect the computer to know what you mean, retardo! I run a Win32 PPM repository for perl 5.6x+5.8x. I take requests. ** The Third rule of perl club is a statement of fact: pod is sexy.

I'm surprised that Perl uses this way to open files with magic ARGV.

Why? This feature existed long before open had 3 arguments, why would it suddenly change.

There's more than 2 and 3 argument open. There's also sysopen, which would behave properly, and which exists since 5.002, dating back to March 1996.

And nobody in his right mind would expect the magic <> to be actually implemented in Perl. Do you? I think, not. C provides far less dangerous library functions.

Why? This feature existed long before open had 3 arguments, why would it suddenly change.

I didn't think it would use normal perl open internally. Given that two-arg open enables command execution and that at that time only one- and two-arg open existed, I think it should have opened files by other means.

But we live in a world that has three-arg open now. It's time to change, imo.

Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }