3 ms·
I believe it's enabled under mod_perl. If that someone was allowing user input to make it to an open, system, or back tick call unfiltered then this is just one
by Moto7451 13y ago
I believe it's enabled under mod_perl. If that someone was allowing user input to make it to an open, system, or back tick call unfiltered then this is just one thing to worry about. It's as bad or worse than taking unfiltered input and building an SQL query with it.
Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.
- ars 13y agoI don't know what they did, it's not my code, but they are not experienced and I suspect they don't know to watch out for this. > Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command. Obviously every language has ways to cause this. It's just that open is the default command. This extra functionality should be in a openshell command or something, and the regular open not have it. (And yes I'm aware it's way too late to change it.)