Programming Perl, 4th Edition

Code Masquerading As Data

Safe compartments are available for when the really scary stuff is going down, but that doesn’t mean you should let down your guard totally when you’re doing the everyday stuff around home. You need to cultivate an awareness of your surroundings and look at things from the point of view of someone wanting to break in. You need to take proactive steps like keeping things well lit and trimming the bushes where various lurking problems can hide.

Perl tries to help you in this area, too. Perl’s conventional parsing and execution scheme avoids the pitfalls to which shell programming languages often fall prey. There are many extremely powerful features in the language, but by design they’re syntactically and semantically bounded in ways that keep things under the programmer’s control. With few exceptions, Perl evaluates each token only once. Something that looks like it’s being used as a simple data variable won’t suddenly go rooting around in your filesystem.

Unfortunately, that sort of thing can happen if you call out to the shell to run other programs for you, because then you’re running under the shell’s rules instead of Perl’s. The shell is easy to avoid, though—just use the list-argument forms of the system, exec, or piped open functions. Although backticks don’t have a list-argument form that is proof against the shell, you can always emulate them as described in the section Accessing Commands and Files Under Reduced Privileges, earlier in this chapter. ...