Re^2: How to do regex backreferences within $variable replacement text?

Replies are listed 'Best First'.
Re^3: How to do regex backreferences within $variable replacement text? by sk (Curate) on Sep 17, 2005 at 19:49 UTC
~~GrandFather missed another `e`~~. GrandFather fixed it `$user_defined_string =~ s/$user_defined_search/$user_defined_replace/e +eg; __END__ before: abcabcabc after: ---a---bc---a---bc---a---bc` [download] Now back to your security issue, here is a simple thing to do as a replacement and you will get the username. In otherwords it is really dangerous as pointed out by Zaxo and GrandFather my $user_defined_replace = '`whoami`'; before: abcabcabc after: xxx bcxxx bcxxx bc [download] Note: in the above xxx stands for the username Update: I might be wrong but I cannot see a nice way to handle user definied substitutions... If you give them control to becomoe part of your script (i.e. they give some code to be executed inside your script) then they can do whatever they want... A better would be to look through the string they send you and check for potentially harmful substitutions like backticks and other operators and then not execute if present.	[reply] [d/l] [select]
Re^4: How to do regex backreferences within $variable replacement text? by Hue-Bond (Priest) on Sep 18, 2005 at 01:17 UTC
A better would be to look through the string they send you and check for potentially harmful substitutions Better than that is to filter everything except known-good characters, like we do when untainting data. In fact, the OP program should run under taint mode. -- David Serrano	[reply]
Re^3: How to do regex backreferences within $variable replacement text? by GrandFather (Saint) on Sep 17, 2005 at 19:56 UTC
Sorry, coffe effect still applies: it needs two eval switches (now updated). You can't do it without evaluation in some form. You could parse the replaced string for $n's and then replace those with their respective captured text. I'll post something in a while Perl is Huffman encoded by design.	[reply]
Re^3: How to do regex backreferences within $variable replacement text? by ManFromNeptune (Scribe) on Sep 17, 2005 at 19:51 UTC
DOH, just realized that you had "/ee" ... tried that and it did indeed work :) But this is still basically an eval(), right?	[reply]
Re^4: How to do regex backreferences within $variable replacement text? by ikegami (Patriarch) on Sep 17, 2005 at 21:00 UTC
Yup. `s/.../.../ee` is the same as `s/.../eval .../e`	[reply] [d/l] [select]
Re^5: How to do regex backreferences within $variable replacement text? by ManFromNeptune (Scribe) on Sep 17, 2005 at 21:08 UTC
Ok, thanks... but really I'm trying to avoid using eval() (or /e) in the first place. <RANT> Seeing as Perl lets you specify regex patterns in variables used for search text (s/$pattern/), it really seems like there ought to be a non-kludgy way to interpret backreferences from a variable in the replacement text (s/$pattern/$replacecontainsbackrefs/) ... </RANT>	[reply]
Re^6: How to do regex backreferences within $variable replacement text? by BUU (Prior) on Sep 17, 2005 at 22:19 UTC