If tainting was employed, it defeats the purpose of using the shorthand notation in the first place.Why? If you're using a simple -n/-p one-liner from the CLI, you can still do that with -T. Your one-liner will still run fine, except for the one time that you do have a filename ending with '|' (or starting with '<', '>' or '|'). I assume you don't have the habit of using such filenames all the time.
This cannot be anticipated by the perl program. Perl gets @ARGV as it is from the executing shell because the shell has already done the expansion.Yes, but it can be anticipated by the person running the program.
I mean, bad filenames may be created unintentionally by some other program working in tandem with perl's <ARGV>.Which means, the environment is untrusted. That really isn't any different from:
if the input is created by a program that unintentionally produces a name of an important file, you also have a problem. Again, a problem that could have been prevented by checking the data you got from the outside (and enabling tainting means Perl checks whether you've checked).while (<STDIN>) { # No magic open chomp; unlink or die; }
In reply to Re^7: magic-diamond <> behavior -- WHAT?!
by JavaFan
in thread magic-diamond <> behavior -- WHAT?!
by repellent
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |