in reply to Re: Execute a Perl code without ".pl" extension
in thread Execute a Perl code without ".pl" extension

Be careful, it may bite you in production environment because the environment of a user isn't garanteed, and many systems have several perl executables installed... Especially, don't do that on a web environment, it may be a huge security risk.
  • Comment on Re^2: Execute a Perl code without ".pl" extension

Replies are listed 'Best First'.
Re^3: Execute a Perl code without ".pl" extension
by izut (Chaplain) on Mar 10, 2006 at 11:45 UTC

    I work basically with Red Hat environments, just one Perl installed. I can't see the point using that in a web environment. Did you mean CGI or mod_perl? If it is mod_perl, does it cares as Apache uses the embedded interpreter? And about the CGI case, I think env will load the environment of user that is supposed to run the web server, or am I wrong?

    Igor 'izut' Sutton
    your code, your rules.

[reply]
[d/l]

      It shouldn't be a problem with mod_perl actually, but in CGI mode it uses the apache environment; you can't really be sure that there isn't an executable somewhere called "perl" that isn't what you expect it to be...

      Here's the Apache $PATH on my RHEL 4 system : /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin

      And here's the path for some regular user : /usr/kerberos/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:/opt/bin

      Someone for some reason, may have installed for instance a setuid perl as /usr/sbin/perl, which isn't in the user's path, but would be run FIRST by Apache... And here's your CGI running as root, howdy!

      Well, I hope you've got my point : using #!/bin/env perl for your own personal scripts is OK, but please don't do that for production code.

[reply]
[d/l]

        Thanks for making this clearer :)

        Igor 'izut' Sutton
        your code, your rules.

[reply]

In Section Seekers of Perl Wisdom