Running perl
one-liners from command line has security implications.
The problem is that options -n/-p
trigger the diamond operator <>
, which use two arguments form of open
, so with files name contain special characters, perl
doesn't work as expected:
$ perl -pe '' 'uname|'
Linux
Or more dangerous when files name starting with >
, like >file
. In this case, file will be truncated.
For work around with this issue, we can:
- Use ARGV::readonly module from CPAN.
- Implement feature like
ARGV::readonly
module by ourself:
perl -pe 'BEGIN{$_.="\0" for @ARGV} ...' ./*
- Use
-i
option, asperl
will check for file existed before processing it. - Use
-T
option to enable taint mode.
I think all solutions can fix this issue, but also have their side effects. If we can force perl
always use thee argument form of open
, it'll be a better solution.
I wonder can we do it, force perl
always use thee argument form of open
?
Note
The question only apply for the case when running perl
one liners from command line, because (of course) we can always use three argument form of open
in Perl script.
perl -pe '' 'uname|'
isn't what people would expect, and would have thought the greater danger isperl -pe"1" ">myfile"
. I think all command-line input files should be opened using three-parameter form with the second parameter always set to<
.'uname|'
is a valid file name, instead of open it, commanduname
is executed and pipe toperl
. And imaging that the command can berm -rf $HOME
. Yes, except for-i
option, when you want to edit file in-place. You can read the link I gave in my question for more details.