Re: Re: print real newlines in place of literal ones

Uh...

Just a note that this can be a little dangerous. In the worst case, the eval will mess up. But if someone just wants to mess with you, they can do a very nice job of it. Observe:

my $line = 'TEXT=};print `ps`;print "Your machine is h4x0r3d!!$/";qq{H
+ello\nWorld!\n';
..

OUTPUT:
  PID  TT  STAT      TIME COMMAND
 5808  p0  S      0:00.02 _su (csh)
 5816  p0  S+     0:00.01 perl mylittleprogram.pl
 5817  p0  R+     0:00.00 ps
  149  v0  IWs+   0:00.00 /usr/libexec/getty Pc ttyv0
Your machine is h4x0red!!
Hello
World
#
[download]

I'm just showing that this can be a little dangerous but if you're the only one who is writing to the config file, you'll need to make certain you never use } or you'll most likely get $interpolated = undef. Of course, a prankster could put some code in the config file as I just showed and have it do a lot of nifty things and you still get the output you expected. So it could be some time before you'd realize anything is wrong at all. Of course, what are the chances of that? ;-)

antirice
The first rule of Perl club is - use Perl
The ith rule of Perl club is - follow rule i - 1 for i > 1

Comment on Re: Re: print real newlines in place of literal ones Download Code

Replies are listed 'Best First'.
Re: Re: Re: print real newlines in place of literal ones by Aragorn (Curate) on Jun 06, 2003 at 07:33 UTC
I know ;-) But the previous posts basically asserted that without some substitution, it wasn't possible to do this. When using this technique, you'll want to turn on taint checking and thus be forced to inspect the input (the `TEXT=...` in this case). But while doing that, it's probably easier to make the substitution right away, thereby removing the need for the `eval` altogether! Sometimes, using this technique (or the `do EXPR` function) is useful for writing a script which uses a configuration file without using a special module for it. It's just another way of doing something, and can be very convenient sometimes. Arjen	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re: Re: Re: print real newlines in place of literal ones
by Aragorn (Curate) on Jun 06, 2003 at 07:33 UTC

TEXT=...

eval

Sometimes, using this technique (or the do EXPR function) is useful for writing a script which uses a configuration file without using a special module for it. It's just another way of doing something, and can be very convenient sometimes.

Arjen

[reply]
[d/l]
[select]