fun with taint and Getopt::Long

ddick on 2007-06-17T12:39:24

save following code as test.pl

#! /usr/bin/perl -wT

use Getopt::Long();
use strict;

$ENV{'PATH'} = '/bin:/usr/bin:/sbin';
delete @ENV{'IFS', 'CDPATH', 'ENV', 'BASH_ENV'};

MAIN: {
        my ($file);
        Getopt::Long::GetOptions('file:s', \$file);
        system("echo $file");
}

run the following commands

$ test.pl --file blah
Insecure dependency in system while running with -T switch at test.pl line 12.
$ test.pl --file=blah
blah
$ perl -e 'print "Wtf???\n";'

---

I bet 20 quid…

Aristotle on 2007-06-17T15:52:17

… that it’s because in the --file=blah case, the parameter gets extracted with a regex match and in the --file blah case, it’s just taken verbatim from @ARGV.