8

Running perl one-liners from command line has security implications.

The problem is that options -n/-p trigger the diamond operator <>, which use two arguments form of open, so with files name contain special characters, perl doesn't work as expected:

$ perl -pe '' 'uname|'
Linux

Or more dangerous when files name starting with >, like >file. In this case, file will be truncated.

For work around with this issue, we can:

  • Use ARGV::readonly module from CPAN.
  • Implement feature like ARGV::readonly module by ourself:

perl -pe 'BEGIN{$_.="\0" for @ARGV} ...' ./*

  • Use -i option, as perl will check for file existed before processing it.
  • Use -T option to enable taint mode.

I think all solutions can fix this issue, but also have their side effects. If we can force perl always use thee argument form of open, it'll be a better solution.

I wonder can we do it, force perl always use thee argument form of open?

Note

The question only apply for the case when running perl one liners from command line, because (of course) we can always use three argument form of open in Perl script.

2
  • I understand your point, but I don't see how the output of perl -pe '' 'uname|' isn't what people would expect, and would have thought the greater danger is perl -pe"1" ">myfile". I think all command-line input files should be opened using three-parameter form with the second parameter always set to <.
    – Borodin
    Nov 29, 2014 at 11:39
  • @Borodin: 'uname|' is a valid file name, instead of open it, command uname is executed and pipe to perl. And imaging that the command can be rm -rf $HOME. Yes, except for -i option, when you want to edit file in-place. You can read the link I gave in my question for more details.
    – cuonglm
    Nov 29, 2014 at 12:12

3 Answers 3

4

You probably only want to do this for one-liners (using the -e switch), so you'll want to customize ARGV::readonly for that purpose.

package Sanitize::ARGV;
if ($0 eq '-e') {
    @ARGV = map {  # from ARGV::readonly
        s/^(\s+)/.\/$1/;
        s/^/< /;
        $_.qq/\0/;
    } @ARGV;
}
1;

To force this package to be used system-wide, you can use an alias as Patrick J.S. suggests

alias perl='perl -MSanitize::ARGV'

or set a system-wide PERL5OPT variable

PERL5OPT="-MSanitize::ARGV"

And if you want to be more paranoid, hide your system perl (rename it to something unintelligible) and replace it with a wrapper

#!/bin/bash
THE_REAL_PERL=/usr/bin/glorbqweroinuerqwer
$THE_REAL_PERL -MSanitize::ARGV "$@"

The shell wrapper will still respect any user customizations to PERL5OPT


In the general case, you can use the CORE::GLOBAL mechanism to override the builtin open function, e.g.

package SafeOpen;
use Carp;
BEGIN {
    *CORE::GLOBAL::open = sub (*;$@) {
        goto &CORE::open if @_ > 2;
        Carp::cluck("OH MY GOD USING THE TWO-ARG open ARE YOU LIKE INSANE?");
        return CORE::open($_[0], '<', $_[1] // $_[0]);
    };
}
1;

and when this module is in use you will catch anyone in the act of using a 2-arg open call. Unfortunately, I think the mechanism of the ARGV filehandle magic bypasses this, so it still doesn't help with goofy filenames on the command line in a one-liner.

3
  • Yes, I know the ways to sanity check @ARGV. My question is about is there anyway to force perl to use three argument open?
    – cuonglm
    Sep 24, 2015 at 16:09
  • You can set up a CORE::GLOBAL::open sub (and I tried it to see if it would solve your problem), but I think the ARGV mechanism magic bypasses it.
    – mob
    Sep 24, 2015 at 16:11
  • Well, that's what I mentioned in my question. And I guess set up CORE::GLOBAL::open have no effects. Since when the -n and -p switch trigger the diamond operator <>, which use the two arguments form of open.
    – cuonglm
    Sep 24, 2015 at 16:22
2
+200

In my previous answer, I hypothesized that ARGV filehandle magic emulated the 2-argument open but didn't actually go through Perl's builtin open function. So I investigated it some more and I think I came up with an actual solution to this problem.

The function Perl_nextargv in doio.c is where perl performs I/O around the ARGV filehandle.

Inside that function's while loop, there are two kinds of calls to open filehandles. When LIKELY(PL_inplace) is true (i.e., when perl is run with the -i switch), the call is do_open_raw. When LIKELY(PL_inplace) is false, the call is to do_open6. The latter call is capable of opening pipes to external commands, which is in general what the OP does not want.

So here's the solution: in the source file doio.c, replace those do_open6 call(s) in Perl_nextargv with do_open_raw and rebuild perl from source. For perl-5.22.0, the original code looks like

    if (LIKELY(!PL_inplace)) {
        if (nomagicopen
                ? do_open6(gv, "<", 1, NULL, &GvSV(gv), 1)
                : do_open6(gv, PL_oldname, oldlen, NULL, NULL, 0)
           ) {
            return IoIFP(GvIOp(gv));
        }
    }

and the altered code looks like

    if (LIKELY(!PL_inplace)) {
        if (do_open_raw(gv, PL_oldname, oldlen, O_RDONLY, 0)) {
            return IoIFP(GvIOp(gv));
        }
    }

(the nomagicopen parameter is true when you use the new <<>> syntax from perl 5.22.0. I guess we could just set it to true at the top of the function and not have to change anything else, but the change above is a general solution for older perl's).

Sample output:

$ original-perl -pe '' a b c 'date|'
Can't open a: No such file or directory
Can't open b: No such file or directory.
Can't open c: No such file or directory.
Mon Sep 21 18:41:37 PDT 2015

$ modified-perl -pe '' a b c 'date|'
Can't open a: No such file or directory.
Can't open b: No such file or directory.
Can't open c: No such file or directory.
Can't open date|: No such file or directory.
2
  • +1 for hacking perl source. I wonder why perl still used two arguments form? Does changing <> behave like <<>> break backward compatible?
    – cuonglm
    Sep 25, 2015 at 5:59
  • It's Perl, so yeah, there are probably scripts out there that depend on this behavior. Maybe someday we will have -N and -P switches like -n and -p that wrap the script in while(<<>>) { ... }.
    – mob
    Sep 25, 2015 at 13:25
1

You could use ARGV::readonly in combination with alias:

alias perl='perl -MARGV::readonly'

Or just educate the people that are typing the "bad" oneliners.

1
  • 2
    Or you could add -MARGV::readonly to the PERL5OPT environment variable
    – mob
    Sep 24, 2015 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.