Hello,
I'm writing script to parse configuration files in perl. I would like to enable regular expressions as part of configuration file. I.e I would like to enable the users to select files that will be proceeded by the script using regex. I was wondering, is it possible for the user to execute some script, command, code, etc. via specially crafted regular expression.
Thank you for your answer in advance.
I don't think so. It depends what your code actually is of course, if you do silly things like throw 'eval' around then there could be holes everywhere..
To my understanding, the problem could be narrowed down to the ability of the user to close my regex line with valid regex characters, and add system("do_something_nasty"); to the script for example. In other hand I'm not quite sure how exactly one perl script is being translated and executed. I.e. is it fraction by fraction, or it's all translated prior to execution, and then binary code is executed ?
It's not going to execute backticks stored inside inside a variable unless you do silly things like stuff it in an eval.
So again, it depends on your code.
That suits me perfect ! Thank you for your fast replay.