3 ms·
It's really just that Shellshock becomes viable only when HTTP headers are passed to your code as environment variables. For CGI, this is the way things are don
by btown 12y ago
It's really just that Shellshock becomes viable only when HTTP headers are passed to your code as environment variables. For CGI, this is the way things are done, and most Perl scripts interact with the web server through CGI. On the other hand, Ruby and $languageoftheweek are usually called through a server framework like WSGI or Rack, which have their own ways of getting HTTP headers to the user code besides passing them as environment variables. Perl has PSGI ( plackperl.org ) but it's more commonly used in CGI.
- btilly 12y agoPerl has PSGI ( plackperl.org ) but it's more commonly used in CGI. Citation needed. I've been a serious Perl programmer since the 90s who has written public facing code at at least a half-dozen companies in the last decade. I've seen all kinds of combinations of things like mod_perl, fastcgi and Plack, but not once CGI. I don't doubt that there are still some toy websites that run old CGI programs written in Perl. But I haven't seen them in the wild. And that niche has been replaced by PHP.
- csirac2 12y agoI spent four years mostly on perl 2009-2012, and again briefly last year. The performance of any non-trivial perl web app is laughably bad when you run as CGI. I've never run prod systems without psgi or mod_fcgid.