Re: Can System() of Perl be bypassed?

From: Sandeep Giri (sandeepgiri@indiatimes.com)
Date: 01/23/03

  • Next message: Valdis.Kletnieks@vt.edu: "Re: Standards for developing secure software" 
    Date: 23 Jan 2003 07:08:15 -0000
From: Sandeep Giri <sandeepgiri@indiatimes.com>
To: secprog@securityfocus.com
    ('binary' encoding is not supported, stored as-is) In-Reply-To: <87fzrku98r.fsf@abra.ru>

    Hi!
    Thanks a lot to you and all who replied to my mesg.
    Taking chapter from replies,now I've changed my code to:

    #!/usr/bin/perl -T -W
    my $key_words;
    my $help;
    GetOptions('kw=s' => \$key_words,
                 'help' => \$help) || usage();
    my @args = ($Keywords,....);
    my @cmd = ("$JAVA",
                 "-search.home=$SEARCH_HOME",
                 "Searcher",
                 @args);
    system(@cmd) == 0) ||error();

    Need I be more paranoid than this and use my own regex to filter out
    keywords my self?

    Thanks a lot.

    Sandeep Giri

    Relevant Pages

    • OOo-XML-Export-Filter
      ... Dabei habe ich als erstes einen einfachen Filter geschrieben, ... die OOo-Elemente nach tbook zu transformieren. ... Wenn ich mit einer externen Transformation das erzeugte OOo-XML nach tbook umwandle, ... Zusätzlich ist mir aufgefallen, dass das Encoding ein anderes ist, obwohl in xsl:output das Encoding angegeben ist. ...
      (de.comp.text.xml)
    • Re: Image filters
      ... /ASCII85Decode filter ... in witch I put the charcters while I am encoding, ... and then I follow the algorithm. ... the encode I created to build the output? ...
      (comp.lang.postscript)
    • Re: MT NewsWatcher filtering
      ... It'll match those specific characters. ... It'd be better to filter on ... encoding. ... Don't bother with piddly crap like "gun control". ...
      (comp.sys.mac.system)
    • ordered keywords?
      ... to set defaults and initiate values and args to set the order of expressions. ... This comes close to the same pattern used in SVG and other formats where you have definitions before expressions. ... If I use keywords only, It won't keep the order, and if I use args before keywords, I have to pre-assign temporary 'None' values to the arguments in the parent or global scope. ...
      (comp.lang.python)
    • MIDL or C++ interface ?
      ... Which are the good reason to use MIDL to write a directshow filter interface ... These args, are that proxy/stub are generated and that it's necessaray to ...
      (microsoft.public.win32.programmer.directx.video)