in reply to Re^7: hex code passed from command line is interpreted literally in substitution
in thread hex code passed from command line is interpreted literally in substitution

You're using string eval, its a problem right now, just because I didn't provide working exploit on purpose

Please enlighten me then on how eval works. I just don't see any reason why it would execute anything other than what I give it, ie, s///.

You do absolutely nothing to ensure that can't happen. The cheapest option is to use taint (-T)

I agree, there would be no harm in using that.

If this is just a program for personal use, why wouldn't you simply use perl -E ... ?

It is a program that iterates through several files and processes them. I wouldn't want to type all of that on the command line every time.

I'm not resisting your help, I just am not understanding why eval would do what you say it would.

I am also wondering why two other monks suggested it.
  • Comment on Re^8: hex code passed from command line is interpreted literally in substitution

Replies are listed 'Best First'.
Re^9: hex code passed from command line is interpreted literally in substitution
by Anonymous Monk on Mar 10, 2011 at 18:19 UTC
    It is a program that iterates through several files and processes them. I wouldn't want to type all of that on the command line every time.

    But that is exactly what you are doing every time you use string eval, you're creating a mini perl program, from stuff you typed on the commandline, might as well just use -E and avoid eval altogether 

    $ perl -E " say @ARGV" say 6
say6

$ perl -E " eval qq!@ARGV!" say 6
6

    [download]

    I am also wondering why two other monks suggested it.

    Branfart :) It is the shortest answer to your question, but its also the most dangerous one. See String::Interpolate

[reply]
[d/l]
      Please enlighten me then on how eval works. I just don't see any reason why it would execute anything other than what I give it, ie, s///.

      Question answered
[reply]
Re^9: hex code passed from command line is interpreted literally in substitution
by ikegami (Patriarch) on Mar 10, 2011 at 19:25 UTC

    I am also wondering why two other monks suggested it.

    I believe you are referring to bart and I.

    I simply said it's required to execute Perl code. I never suggested that you use Perl code as inputs — that extremely rarely makes sense — so I never suggested that you use eval.

[reply]
[d/l]
      I'm sorry, I retract that.

      Would you agree then with AM, that it would be possible for eval to execute a system command if the appropriate code were typed in and used as one of the variables in the string below: 
      
eval "s/$arg_1/$arg_2/";

      [download]
[reply]
[d/l]

        Most definitely: 

        $arg1 = '//; system( ... ); #';

        [download]

        Or without even breaking out of the s///: 

        $arg1 = '${ system( ... ) }';

        [download]
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom