in reply to Insecure dependency in system under -T, with list form invocation

I don't have ClearCase::Argv with which to test your code and I don't use ClearCase. Where are you untainting $host and the elements of @lbtype, though? Also, you don't seem to be using $me at all, unless some module is referring to variables in your main namespace.

Replies are listed 'Best First'.
$0 in suid enabled script
by cramdorgi (Acolyte) on Sep 15, 2008 at 12:50 UTC
    Hi,

    I did use the basename of $0 in my usage function. This worked fine as long as I was running the script normally.
    But as soon as I installed it as suid, the $0 turned to contain something like /dev/fd/4 (i.e. the file descriptor under which perl had opened the script, and which was passed to a child process, running under the new id, I assume).

    So, how is a script supposed to know under what name it was invoked, if suid'd?

    Is this a specific problem on Solaris?

[reply]
[d/l]
      there is caller and __FILE__ 
      C:\>more temp.pl
#!/usr/bin/perl --
use strict;
use warnings;

my ($package, $filename, $line) = eval { caller };

print "\$0 $0\n";
print "filename $filename\n";
print "__FILE__ ", __FILE__,"\n";

__END__


C:\>perl temp.pl
$0 temp.pl
filename temp.pl
__FILE__ temp.pl

C:\>

      [download]
[reply]
[d/l]

        Since $0 isn't anything like "/dev/fd/4" above, you haven't demonstrated that your assumptions apply in the situation described. I'd be quite surprised if they did. You show 3 different ways of getting exactly the same string. When $0 returns "/dev/fd/4", the other two most likely return that exact same string as well.

        - tye        

[reply]

In Section Seekers of Perl Wisdom