Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

Re^2: The importance of avoiding the shell

by jhourcle (Prior)
on Sep 25, 2014 at 11:53 UTC ( [id://1101961]=note: print w/replies, xml ) Need Help??


in reply to Re: The importance of avoiding the shell
in thread The importance of avoiding the shell

Notice how in my first test, I called sh? Some OSes (these examples were from a MacOS X box) use bash for sh.

You should run the tests and check if you're vulnerable. Don't just think 'oh, it won't happen to me, I'm using ksh', as perl may still send to a vulnerable sh:

sh-3.2$ ksh $ set -o emacs $ env x='() { :;}; echo vulnerable' ksh -c "echo this is a test" this is a test $ env x='() { :;}; echo vulnerable' perl -e 'system "echo test;"' vulnerable test

Replies are listed 'Best First'.
Re^3: The importance of avoiding the shell
by mr_mischief (Monsignor) on Sep 26, 2014 at 13:51 UTC

    This is why Corion, whom I assure you is not an idiot, mentioned the concept of the default shell. Please do read what you are responding to before repeating what was just said in a haughty way.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://1101961]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others perusing the Monastery: (7)
As of 2024-03-28 19:02 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found