Re: capture exception

Perrin Harkins <[email protected]> Tue, 30 May 2017 10:51:55 -0400

Newsgroups	gmane.comp.apache.mod-perl
Message-ID	<CAC0_be1iXK9b4gQBQiYRUqu+nKbTU-9STtEQGiK78gAUG7h0nw@mail.gmail.com>

https://www.effectiveperlprogramming.com/2011/03/know-the-different-evals/

On Tue, May 30, 2017 at 10:49 AM, Dirk-Willem van Gulik <
[email protected]> wrote:

>
> On 30 May 2017, at 16:43, John Dunlap <[email protected]> wrote:
>
> How is it a security hole?
>
> ….
>
> > my $ret = eval { $m->...() };
>
>
> Just imagine $m->…() returning something containing a valid perl
> expression such as " `rm -rf /‘; “, system(“rm -rf /“);  or something that
> wires up a shell to a TCP socket.
>
> Dw.
>
>