develooper Front page | perl.perl5.porters | Postings from July 2008

RE: Alarums and Excursions (was [perl #2783] Security of ARGVusing 2-argument open)

Thread Previous
From:
Ed Avis
Date:
July 28, 2008 09:25
Subject:
RE: Alarums and Excursions (was [perl #2783] Security of ARGVusing 2-argument open)
Message ID:
7A5C308A1A3D554B8B8C0E331F7D2BB10ECCB2@wcl-exc.wcl.local
Abigail wrote:

>There was an official survey?

No, just a 'little survey' right here in this thread.

>I certainly have used magical 
>2-arg open more than once, although I cannot recall whether 
>that was in combination with '<>'.

Noted.  I've used 2-arg open for pipes a lot too, in the old days, and still do sometimes.

>But you don't know. It's just the putting your finger in the 
>wind, querying the handful of people who happen to read this 
>thread. The fast majority of Perl programmers doesn't read 
>p5p. In fact, the fast majority of the Perl programmers out 
>there doesn't read any mailinglist, nor do they participate in 
>anyway in the "Perl community". Only a tiny minority has code on CPAN.

That is right.  All you can do is look at the perl code which is out there (at least the subset of it which is in open source projects) and make some reasonable guesses.

As far as I can see, the majority of programmers have been using <> without really being aware that it has any rough edges or security implications at all.

>I remain of the opinion that p5p has always been quite careful 
>about breaking backwards compatability, bending over backwards 
>to avoid breaking even the most obscure construct.

That is a good thing but in this case I feel that the misfeature is serious enough (and the number of intentional uses small enough, and the workaround easy enough) to be worth changing in a perl major version.  We may not get agreement on that.

-- 
Ed Avis <eda@waniasset.com>

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

Thread Previous


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About