This sounds like a job for Capture::Tiny.

Here's the output:

Stdout: 
Stderr: 
Result: print "hi";
[download]

Here's my test code

#!/usr/bin/perl
use URI::Escape;
use HTML::Entities;
use Capture::Tiny qw/capture/;
use CGI qw/:standard/;
print "Content-type: text/html\n\n";

if(param('test')){
        my $code = param('test');
        $code = uri_unescape($code);
        $code = encode_entities($code);
        my($stdout, $stderr, @result) = capture { $code };
        print "Stdout: $stdout\n";
        print "Stderr: $stderr\n";
        print "Result: @result\n";
}
[download]

Obviously what I really want to be returned here is the word: 'hi'. Maybe that clears up what I am trying to do.

Capture::Tiny doesn't actually evaluate a string as code. You still need to use eval (or Safe) for that. Here's a minimal example:

use strict;
use warnings;

use Capture::Tiny qw/capture/;

my $code = 'print "hi"';

my($stdout, $stderr, @result) = capture { eval $code };
print "Stdout: $stdout\n";
print "Stderr: $stderr\n";
print "Result: @result\n";
[download]

The output will be:

Stdout: hi
Stderr: 
Result: 1
[download]

You might be wondering where "1" comes from. print returns true on success, and that propagates through the eval back to capture, which rolls it into the result set.

Now once you introduce Safe (which I suspect you probably will end up doing), things get a lot more complicated really fast, and you'll still be exposed to DOS attacks.




Dave

From my perspective, it would be easier to just redirect STDERR to STDOUT (or perhaps to an in-memory scalar), since warnings bypass the normal $@ error capture in eval. There are instructions for redirecting STDERR in open. You could also modify the $SIG{__WARN__} handler (see %SIG in perlvar). Or, as long as you've tossed security to the wind, maybe you could achieve your goal with CGI::Carp  qw(fatalsToBrowser);?

I tried this but I dont think its everything you were talking about:

#!/usr/bin/perl -w
use URI::Escape;
use HTML::Entities;
use CGI qw/:standard/;
print "Content-type: text/html\n\n";
my $file;
if(param('test')){
        my $code = param('test');
        $code = uri_unescape($code);
        $code = encode_entities($code);
        open STDERR, '>&STDOUT';
                open my $fh, '>', \$file;
                print $fh $code;
                close $fh;
                open my $pipe, '-|', "perl -w $file";
                close $pipe;
        close STDERR;
}
[download]

The output I get with this is:

sh: -c: line 0: syntax error near unexpected token `;;'
sh: -c: line 0: `perl -w print "hi";'
[download]

This is what is passed to the script:

print "hi";
print "hello world\n";
[download]

A modified version of your sample that does what I mean:

#!/usr/bin/perl -w
use strict;

use URI::Escape;
use HTML::Entities;
use CGI qw/:standard/;
use CGI::Carp 'fatalsToBrowser';

print header;

my $file;
if(param('test')){
        my $code = param('test');
        $code = uri_unescape($code);
        $code = encode_entities($code);
        open STDERR, '>&STDOUT';
        eval $code;
        print $@ if $@;
}
[download]

No need to create external, temporary files. There are some potential messy issues in there, but this is good enough for rough cut.

---

#11929 First ask yourself `How would I do this without a computer?' Then have the computer do it the same way.