http://qs321.pair.com?node_id=11113991


in reply to Safely capturing the output of an external program

update

Nevermind I misread your question as already having the path. Sorry.

update

Maybe have a look at IPC::Open3 and IPC::Run

The latter is explicitly talking about avoiding the shell and both offer passing arguments explicitly.

Untested!

Hi

I'm not aware of safe placeholder invocations, and the variety of possible CLI arguments is huge.

But you could consider to examine and untaint your file argument.

-e $file should tell you if it exists (hence not work with evil injections) and examining the path should tell you if it's inside an allowed location.

Cheers Rolf
(addicted to the Perl Programming Language :)
Wikisyntax for the Monastery

Replies are listed 'Best First'.
Re^2: Safely capturing the output of an external program
by AppleFritter (Vicar) on Mar 09, 2020 at 07:58 UTC
    Untainting might work though; if the filename matches, say, q/^[A-Za-z0-9]+\.tfm$/, it's probably safe to pass it through any shell. But I've never liked that approach, and "probably" is a dangerous word.
[reply]
[d/l]
      > Untainting might work though;

      In this case I'd additionally surround arguments with 'singlequotes' .

      Your untainting demo is explicitly forbidding quotes, in other cases escape them.

      Cheers Rolf
      (addicted to the Perl Programming Language :)
      Wikisyntax for the Monastery

[reply]
[d/l]

In Section Seekers of Perl Wisdom