in reply to How ti include a file in Perl script

For configuration files i use the following: The config file: 
$foo=>"bar",
$something=>"whatever",

[download]
And in the file itself I include it like this: 
my %config = do "path/config.pl"
print $config{foo};

[download]

Replies are listed 'Best First'.
Re^2: How ti include a file in Perl script
by TGI (Parson) on Jan 11, 2008 at 06:22 UTC

    And then a bad, bad person comes along and edits your config file to read:

    foo => 'bar',
something => 'whatever';
`rm -rf /`;

    [download]

    Ouch.

    Using a Config module as suggested above is safer, and in many cases just as easy.

    If you need to use perl config files, you may be able to buy yourself some safety by using Opcodes or Safe.


    TGI says moo

[reply]
[d/l]
      I the has access, it's not easy for him to type "rm -rf /" directly instead of modifying my file? Or he could change any other file to programatically remove every file he wants.
      There may be lots of reasons to use Config module instead this, but that it's not one in my opinion.
[reply]

        Depending on how your scripts are run and the permissions on the files involved, your config files may be part of a privilege escalation attack.

        The risk really comes in where there is a difference in permissions between who can alter the config file, who can run the script, and the user the script executes as. If your script runs as setuid root, you give the system to an attacker.

        In your case, the risk may be small. But it is a risk that is easily and cheaply avoided by using a library to serialize your configuration data.


        TGI says moo

[reply]
Re^2: How ti include a file in Perl script
by Saladino (Beadle) on Jan 10, 2008 at 14:40 UTC
    Sorry, the $ on the config file shouldn't be there. 
    foo=>"bar",
something=>"whatever",

    [download]
[reply]
[d/l]
      use strict;
[reply]

In Section Seekers of Perl Wisdom