Re^2: Security issue and solution for terminal command accessed by public user

Hi,

Thanks, that Pipe mode and interactive mode is a great answer. I think it solve most of the problem. The units does have the interactive mode.

Comment on Re^2: Security issue and solution for terminal command accessed by public user

Replies are listed 'Best First'.
Re^3: Security issue and solution for terminal command accessed by public user by pemungkah (Priest) on Jul 08, 2012 at 16:43 UTC
I would, if you decide to go that route, carefully comment why you're doing it that way, so someone doesn't later come along and decide it would be more "efficient" to change it to `system "$unaltered_user_input";` [download] and open you up to the security issues again. I might also ask, will you really need every conversion that `units` can do? Or do you have a small set of conversions that can be encapsulated in a few dozen lines at the most? The investment in a bit of conversion code that is definitely safe, versus a security problem waiting to happen, is probably worth it.	[reply] [d/l]

Replies are listed 'Best First'.

Re^3: Security issue and solution for terminal command accessed by public user
by pemungkah (Priest) on Jul 08, 2012 at 16:43 UTC

system "$unaltered_user_input";
[download]

I might also ask, will you really need every conversion that units can do? Or do you have a small set of conversions that can be encapsulated in a few dozen lines at the most? The investment in a bit of conversion code that is definitely safe, versus a security problem waiting to happen, is probably worth it.

[reply]
[d/l]