What do you do now? My fellow Perlsuers of Wisdom, what would be some of your favorite ways of preventing piped,"&&ed","||ed",";ed", etc. commands?
It all depends on how it's going to be used. If it's going to be a part of something that will be evaluated by a shell, take every precaution you can (although quotemeta often is enough). When using system calls, use the list forms of system, exec and IPC::Open2::open2 and IPC::Open3::open3.
Custom tainting can be done using Taint, but I have yet to find out how that works myself.
U28geW91IGNhbiBhbGwgcm90MTMgY
W5kIHBhY2soKS4gQnV0IGRvIHlvdS
ByZWNvZ25pc2UgQmFzZTY0IHdoZW4
geW91IHNlZSBpdD8gIC0tIEp1ZXJk
In reply to Re: Homegrown Pseudo-Tainting
by Juerd
in thread Homegrown Pseudo-Tainting
by oubiwann
For: | Use: | ||
& | & | ||
< | < | ||
> | > | ||
[ | [ | ||
] | ] |