nice, I didn't know that trick to add "normal" code after the import; part of use 5 =)

Note unfortunately it doesn't end up inside the BEGIN:

$ perl -MO=Deparse '-M5;print "Hello"' -e 'print "World"'
sub BEGIN {
    require 5;
    ()
}
print 'Hello';
print 'World';
[download]

The trick was added to perlsecret as the "Maori Farewell" by Discipulus after I posted about it here.

This is substantially the same logic quirk as the old "ShellShock" bug in bash. Both of these take an expected "data" value (although here the "data" is the name of a module to import instead of the body of a shell function) and then execute code given after that value in the same string.

The best argument against calling this a security issue is that it must be either given on the command line or in $PERL5OPT — and you have bigger problems if either of those is within an attacker's control.

> Note unfortunately it doesn't end up inside the BEGIN:

not with version pragmas, but anything which allows import-list will also execute code inside

d:\>perl "-MData::Dumper print ${^GLOBAL_PHASE}" -e1
START
d:\>
[download]

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery}

Good point, thanks! As for your other reply:

PERL5OPT doesn't allow -e and this most probably for security reasons.

I kind of doubt that's the case, since it does allow -M and -I, and those two can be used to execute arbitrary code from anywhere in the filesystem. I suspect the reason might be that -enp etc. would break things when accidentally used in a global PERL5OPT.

Well you know PERL5OPT doesn't allow -e and this most probably for security reasons.

But this is a backdoor to do it nevertheless.

Not sure if this must be reported.

Cheers Rolf
_{(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery}