This is Perl, of course it's possible to construct a counterexample ;-) Imagine someone wrote their own version of Data::Diver:

use warnings;
use strict;

sub dive {
    my ($data, @path) = @_;
    die "unsafe keys" if grep { /[^a-zA-Z0-9_]/ } @path;
    return eval '$data->'.join('', map { "{$_}" } @path);
}

use Test::More tests=>6;

sub exception (&) { eval { shift->(); 1 } ? undef : ($@ || die) }

our %quz = ( quz => 'Hello!' );
our %foo = ( bar => 'quz', baz => { hello => "World!" } );

is dive(\%quz, qw/ quz /), 'Hello!';
is dive(\%foo, qw/ bar /), 'quz';
is dive(\%foo, qw/ bar x /), undef;
is dive(\%foo, qw/ baz hello /), 'World!';
is dive(\%foo, qw/ bar quz /), undef;
like exception { dive(\%foo, qw/ $hello /) },
    qr/\bunsafe keys\b/i;

[download]

Under no strict 'refs', the code will behave differently and the tests will fail.

Any code with eval is susceptible - for a slightly more realistic scenario, imagine a templating system that is loading data from JSON, for example. Update: Though I think the code above isn't even that unrealistic, given the huge number of modules on CPAN there's bound to be one or two that do something like that. Also added a test case to the above code.

In reply to Re^5: How to import "global" variables into sub-scripts from main script? by haukex
in thread How to import "global" variables into sub-scripts from main script? by Polyglot

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.