in reply to Homegrown Pseudo-Tainting
What do you do now? My fellow Perlsuers of Wisdom, what would be some of your favorite ways of preventing piped,"&&ed","||ed",";ed", etc. commands?
It all depends on how it's going to be used. If it's going to be a part of something that will be evaluated by a shell, take every precaution you can (although quotemeta often is enough). When using system calls, use the list forms of system, exec and IPC::Open2::open2 and IPC::Open3::open3.
Custom tainting can be done using Taint, but I have yet to find out how that works myself.
U28geW91IGNhbiBhbGwgcm90MTMgY
W5kIHBhY2soKS4gQnV0IGRvIHlvdS
ByZWNvZ25pc2UgQmFzZTY0IHdoZW4
geW91IHNlZSBpdD8gIC0tIEp1ZXJk
|
---|