Re: 'safe' printing to the terminal

On 5/9/26 05:42, Michiel Beijen wrote:
> Hi,
> 
> I'm the maintainer of File::MimeInfo, really old perl code, but it and its CLI utilities mimetype and mimeinfo are packaged in all linux distros and according to popcon it's on half of debian installs -- I am not really sure I can trust that data though?
> 
> Anyways; I got a report about a 'vulnerability' in the code where if you'd run `mimetype` on a file it echoes the filename to the terminal:
> 
> $ mimetype README.md
> README.md: text/markdown
> 
> If the filename would happen to contain control characters it can mess up your terminal.
> 
> I know there used to be a discussion about this in gnu coreutils (ls and friends) and there is now quotearg.c which is MANY lines of code.
> 
> Is there a 'best practice' way to achieve something similar in Perl? I'd guess there are many tools in perl that run in the terminal and run user input?
> 
> --
> Michiel


Hello.  :-)


While it does not appear to be as flexible as quotearg.c, 
String::ShellQuote works for me when building command strings to run via 
"qx":

https://metacpan.org/pod/String::ShellQuote


I would advise testing what shell_quote() does when given control 
characters, ANSI escape sequences, Unicode, etc..


See also shell_quote_best_effort().


David