develooper Front page | perl.perl5.porters | Postings from January 2008

Re: [perl #50146] File::Temp and unsafe shell characters

Thread Previous | Thread Next
Ed Avis
January 24, 2008 03:50
Re: [perl #50146] File::Temp and unsafe shell characters
Message ID:
Tim Jenness <t.jenness <at>> writes:

>The directory name is picked up by  File::Spec->tmpdir. Are you saying  
>that the directory name is the problem?


>I realize that the temp directory could include spaces which  
>will break the gzip line unless a multi-arg system is used.

Yes, it could even contain backticks causing some other command to be executed.

>Should File::Temp->tmpdir have a safe mode?

I assume you mean File::Spec->tmpdir.  Yes that would be a good idea.  However
File::Temp is particularly touted as a secure and safe way to generate a
temporary file, so it needs to be extra careful.

I should note that if taint mode is on then the TMPDIR environment variable is
ignored so this becomes unexploitable.  That is a good reason to enable taint
mode.  But I think there should still be a check in File::Temp that the returned
filename doesn't have bad characters.

Ed Avis <>

Thread Previous | Thread Next Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About