perldoc Env -- don't use dot-in-path #16951
Comments
From sdowdy@rap.ucar.edu(NOTE: this is a pet-peeve, and i'm just doing due-diligence, so feel free to ignore and close WONTFIX if you disagree) Please consider removing examples showing 'dot-in-path', as this is long-considered a Don't-Do trojan-horse security vulnerability.[1][2][3] Just as examples of 'kill' that prominently display 'kill -9' create bad end-user default behavior, doing this helps ingrain the notion that '.' in PATH is okay. thanks, (ins)sdowdy@resonance$ perl -V Characteristics of this binary (from libperl): Random examples from a quick google... |
From @jkeenanOn Fri, 12 Apr 2019 19:17:16 GMT, sdowdy@rap.ucar.edu wrote:
[snip]
None of the documents you cite is under the control of the Perl 5 Porters. Should you find examples in the Perl 5 core distribution, please file a new RT. Please contact opengroup.org, oracle.com, etc. to have those examples updated. Thank you very much. |
|
The RT System itself - Status changed from 'new' to 'open' |
|
@jkeenan - Status changed from 'open' to 'rejected' |
From @LeontOn Fri, 12 Apr 2019 12:17:16 -0700, sdowdy@rap.ucar.edu wrote:
Yeah that sounds like a good idea. I'm sure we can come up with a better example. Leon |
|
@Leont - Status changed from 'rejected' to 'open' |
From @tomhukinsOn Sun, Apr 14, 2019 at 04:29:16AM -0700, James E Keenan via RT wrote:
That's correct, but the issue described in the subject is very much I believe reject this ticket mistakenly. Tom |
From @tomhukinsHere's a patch that addresses the problem. Tom |
From @tomhukins0001-Stop-implying-.-belongs-in-ENV-PATH.patchFrom 315e0c5d53cfb586f9ed4449cdab31c75a30536c Mon Sep 17 00:00:00 2001
From: Tom Hukins <tom@eborcom.com>
Date: Mon, 15 Apr 2019 08:07:39 +0100
Subject: [PATCH] Stop implying "." belongs in $ENV{PATH}
Instead, use an arbitrary path that has less chance of encouraging
people to allow the current directory in their path.
[perl #134025]
---
dist/Env/lib/Env.pm | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/dist/Env/lib/Env.pm b/dist/Env/lib/Env.pm
index 6e6cd8b230..dab9872879 100644
--- a/dist/Env/lib/Env.pm
+++ b/dist/Env/lib/Env.pm
@@ -35,7 +35,7 @@ You may access its value
or modify it
- $PATH .= ":.";
+ $PATH .= ":/any/path";
push @LD_LIBRARY_PATH, $dir;
however you'd like. Bear in mind, however, that each access to a tied array
@@ -44,15 +44,16 @@ variable requires splitting the environment variable's string anew.
The code:
use Env qw(@PATH);
- push @PATH, '.';
+ push @PATH, '/any/path';
-is equivalent to:
+is almost equivalent to:
use Env qw(PATH);
- $PATH .= ":.";
+ $PATH .= ":/any/path";
except that if C<$ENV{PATH}> started out empty, the second approach leaves
-it with the (odd) value "C<:.>", but the first approach leaves it with "C<.>".
+it with the (odd) value "C<:/any/path>", but the first approach leaves it with
+"C</any/path>".
To remove a tied environment variable from
the environment, assign it the undefined value
--
2.21.0
|
Instead, use an arbitrary path that has less chance of encouraging people to allow the current directory in their path. This was prompted by Perl#16951 and attached as a patch to that issue which was mistakenly closde without fixing the problem.
Instead, use an arbitrary path that has less chance of encouraging people to allow the current directory in their path. This was prompted by Perl#16951 and attached as a patch to that issue which was mistakenly closde without fixing the problem.
Instead, use an arbitrary path that has less chance of encouraging people to allow the current directory in their path. This was prompted by Perl#16951 and attached as a patch to that issue which was mistakenly closed without fixing the problem.
Instead, use an arbitrary path that has less chance of encouraging people to allow the current directory in their path. This was prompted by #16951 and attached as a patch to that issue which was mistakenly closed without fixing the problem.
Migrated from rt.perl.org#134025 (status was 'open')
Searchable as RT134025$
The text was updated successfully, but these errors were encountered: