"Perl has a nice feature when opening a file with the open() library call, because it not only opens files, but runs programs if the file path is not a path, but a shell command ending in a pipe." I thought only PHP did things like that :) I hope this is disabled in mod_perl? Because if not I need to let someone know they need to audit their code. PS. I get how useful this is, and it's well documented, but this funct…
I believe it's enabled under mod_perl. If that someone was allowing user input to make it to an open, system, or back tick call unfiltered then this is just one thing to worry about. It's as bad or worse than taking unfiltered input and building an SQL query with it. Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.
> Moreover, this isn't a Perl issue. I can think of ways to do similarly I'll advised things with C#'s process.start or C/C++'s System command.
Obviously every language has ways to cause this. It's just that open is the default command. This extra functionality should be in a openshell command or something, and the regular open not have it. (And yes I'm aware it's way too late to change it.)