in reply to Re^2: hex code passed from command line is interpreted literally in substitution
in thread hex code passed from command line is interpreted literally in substitution

Now give your program these magic arguments "destroyer" "`rm -rf \x2f `"
  • Comment on Re^3: hex code passed from command line is interpreted literally in substitution
  • Download Code

Replies are listed 'Best First'.
Re^4: hex code passed from command line is interpreted literally in substitution
by Allasso (Monk) on Mar 10, 2011 at 12:41 UTC
    Yeah, so it replaces the string "destroyer" with the string "`rm -rf \x2f `". So what?
[reply]
      No it doesn't, it executes rm -rf /

      Hopefully, you're not running as root, you're using taint

[reply]
[d/l]
        it doesn't on my machine. I tried it (with a different command just in case I was wrong.) It does not execute the command.

        eval (I believe) is only going to evaluate the string given it. I am not giving it the string "$arg_2", I am giving it the string "s/$arg_1/$arg_2/".

        perhaps if I were using the 'e' flag it would be a problem.

        even if it did what you think it did, I would have to ask, why would I want to do that? That to me is like saying, "go to your terminal, and type rm -rf /".
[reply]
[d/l]

In Section Seekers of Perl Wisdom