in reply to Re: Re: Re: Trojan Horse? (taint mode)
in thread Trojan Horse? (taint mode)
$a = qq|${system("echo 'hello from system'")}\n|; $a = "${system(\"echo 'hello from system'\")}\n";
$a = <stdin>; print "Some string with ${$a}";
But as you stated I'm finding that doesn't work, which is very strange to me. It seems as though it should, and there could be really cool uses for it.
That said, to get somewhat back on the orginal topic using taint mode is still a good idea, especially in CGI scripts. The trick is to learn what should be untainted and what doesn't have to be.
|
---|