get the best and fastest answer
|
|
|
|
Clear questions and runnable code get the best and fastest answer |
|
| PerlMonks |
Re: Re: Re: Re: Two-arg open() considered dangerousby merlyn (Sage) |
| on Dec 12, 2001 at 05:52 UTC ( [id://131144]=note: print w/replies, xml ) | Need Help?? |
|
I think anyone starting a filename with whitespace deserves to suffer.It's not a matter of suffering or not. It's a matter of being able to bypass security. Suppose a setuid script will only write to a file I own, and I want to attack "fred". I create "(space)fred", it checks with "-O" and notes that I own it, and then proceeds to strip the whitespace on the open. And boom, I've written into a file I don't own. Do not simply "ignore" special characters, saying "the user will have to suffer". As a bad guy, I could exploit your ignorance (heh), and get in. Bad design, worse results. -- Randal L. Schwartz, Perl hacker
In Section
Meditations
|
|
||||||||||||||||||||||