Shouldn't this be fixed with 3-argument open?Fixed implies broken. This feature is there by design, and predates perl5. I find it useful.
I really like the magic-diamond for quick one-liners, but this just sounds all the security/robustness alarm bells.One-liners are one-liners. They are there for convenience. Writing secure and/or robust programs means you're going to put in more effort than a one-liner.
One of perl mottos is to make "easy things easy, and hard things possible". Magic open is a form of easy. Writing secure and robust programs is a hard thing. For that, you taint your command line arguments, and use 3-arg open. Note that a simple -T flag prevents your example from doing any harm:
Replacing magic open with 3-arg open means easy things are not so easy any more.$ perl -TwE '$ENV{PATH} = "/bin"; while (<>) {say}' '/bin/rm * |' Insecure dependency in piped open while running with -T switch at -e l +ine 1. $
In reply to Re: magic-diamond <> behavior -- WHAT?!
by JavaFan
in thread magic-diamond <> behavior -- WHAT?!
by repellent
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |