IlyaM's JournalIlyaM's use Perl JournalFalse Security- August 29, 2003 What I don't get is why many ISPs don't allow ssh access to their boxes while at same time they allow you to run your own cgi scripts. If you can run arbitrary CGI then you can run arbitrary code on the server even without shell. On similar note why SourceForge disallow SSH access to their CVS servers when they allow you to modify files in CVSROOT If I can add commit and loginfo scripts there I can run arbitrary code on the server too. For sysamins: better not waste your time on false...http://use.perl.org/~IlyaM/journal/14387?from=rss ExtUtils::MakeMaker and CGI::Carp- August 7, 2003 Today when installing a module on a test server I've been surprised when 'perl Makefile.PL' printed something like: $ perl5.6.1 Makefile.PLThu Aug 7 15:09:35 2003 Makefile.PL: Warning: prerequisite Email::Valid failed to load: Can't locate EmailValid.pm in INC (INC contains: homeperl-5.6.1lib5.6.1i686-linux homeperl-5.6.1lib5.6.1 homeperl-5.6.1libsite_perl5.6.1i686-linux homeperl-5.6.1libsite_perl5.6.1 homeperl-5.6.1libsite_perl .) at (eval 5) line 3.Thu Aug 7 15:09:35 2003...http://use.perl.org/~IlyaM/journal/13968?from=rss while() ... considered harmful continued ...- August 4, 2003 For background see this perlmonks node. Seeing a recent patch at bug report 23141 makes me wonder if doing local $_; while() ... will stop working too in general case. In other words if I get things correctly with this patch no CPAN module can use $_ even if it is localized because $_ may be readonly or have some magic attached to it and local will not remove it. Looks like using local with global variables is almost always bad idea unless callee can allow certain assuptions about callers...http://use.perl.org/~IlyaM/journal/13897?from=rss |