20914e3753
Viktor Szakats
2026-03-26
Subject
perl: harden external command invocations
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
docs/examples/adddocsref.pl +4 -2scripts/checksrc-all.pl +3 -2scripts/singleuse.pl +4 -5tests/data/test1707 +1 -1tests/data/test1708 +1 -1tests/data/test1710 +1 -1tests/libtest/test1013.pl +1 -1tests/libtest/test1022.pl +1 -1tests/libtest/test307.pl +1 -1tests/test1275.pl +5 -1tests/test1707.pl +2 -7
docs/examples/adddocsref.pl+4 -2
| @@ -28,6 +28,8 @@ | |
| use strict; | |
| use warnings; | |
| + | use File::Copy; |
| + | |
| my $docroot="https://curl.se/libcurl/c"; | |
| for my $f (@ARGV) { | |
| @@ -56,6 +58,6 @@ for my $f (@ARGV) { | |
| close(F); | |
| close(NEW); | |
| - | system("mv $f $f.org"); |
| - | system("mv $f.new $f"); |
| + | move($f, "$f.org"); |
| + | move("$f.new", $f); |
| } | |
scripts/checksrc-all.pl+3 -2
| @@ -13,7 +13,7 @@ use Cwd 'abs_path'; | |
| my @files; | |
| my $is_git = 0; | |
| if(system('git rev-parse --is-inside-work-tree >/dev/null 2>&1') == 0) { | |
| - | @files = `git ls-files \"*.[ch]\"`; |
| + | open(O, '-|', 'git', 'ls-files', '*.[ch]') || die; push @files, <O>; close(O); |
| $is_git = 1; | |
| } | |
| else { | |
| @@ -33,7 +33,8 @@ my $anyfailed = 0; | |
| for my $dir (@dirs) { | |
| if($is_git) { | |
| - | @files = `git ls-files \"$dir/*.[ch]\"`; |
| + | @files = (); |
| + | open(O, '-|', 'git', 'ls-files', "$dir/*.[ch]") || die; push @files, <O>; close(O); |
| chomp(@files); | |
| } | |
| else { | |
scripts/singleuse.pl+4 -5
| @@ -36,9 +36,9 @@ | |
| use strict; | |
| use warnings; | |
| - | my $unittests=""; |
| + | my @unittests; |
| if(@ARGV && $ARGV[0] eq "--unit") { | |
| - | $unittests = "tests/unit "; |
| + | push @unittests, 'tests/unit'; |
| shift @ARGV; | |
| } | |
| @@ -167,7 +167,7 @@ my %api = ( | |
| sub doublecheck { | |
| my ($f, $used) = @_; | |
| - | open(F, "git grep -Fwle '$f' -- lib ${unittests}projects|"); |
| + | open(F, '-|', 'git', 'grep', '-Fwle', $f, '--', 'lib', @unittests, 'projects'); |
| my @also; | |
| while(<F>) { | |
| my $e = $_; | |
| @@ -182,8 +182,7 @@ sub doublecheck { | |
| return @also; | |
| } | |
| - | open(N, "nm $file|") || |
| - | die; |
| + | open(N, '-|', 'nm', $file) || die; |
| my %exist; | |
| my %uses; | |
tests/data/test1707+1 -1
| @@ -17,7 +17,7 @@ Verify curl -h --insecure | |
| </name> | |
| <command type="perl"> | |
| - | %SRCDIR/test1707.pl %CURL --insecure %LOGDIR/help%TESTNUMBER ../docs/cmdline-opts/curl.txt |
| + | %SRCDIR/test1707.pl %CURL --insecure ../docs/cmdline-opts/curl.txt |
| </command> | |
| </client> | |
tests/data/test1708+1 -1
| @@ -17,7 +17,7 @@ Verify curl -h -F | |
| </name> | |
| <command type="perl"> | |
| - | %SRCDIR/test1707.pl %CURL -F %LOGDIR/help%TESTNUMBER ../docs/cmdline-opts/curl.txt |
| + | %SRCDIR/test1707.pl %CURL -F ../docs/cmdline-opts/curl.txt |
| </command> | |
| </client> | |
tests/data/test1710+1 -1
| @@ -17,7 +17,7 @@ Verify curl -h --no-clobber | |
| </name> | |
| <command type="perl"> | |
| - | %SRCDIR/test1707.pl %CURL --no-clobber %LOGDIR/help%TESTNUMBER ../docs/cmdline-opts/curl.txt |
| + | %SRCDIR/test1707.pl %CURL --no-clobber ../docs/cmdline-opts/curl.txt |
| </command> | |
| </client> | |
tests/libtest/test1013.pl+1 -1
| @@ -48,7 +48,7 @@ my @curl = split / /,$1; | |
| # Read the output of curl-config | |
| my @curl_config; | |
| - | open(CURLCONFIG, "sh $ARGV[0] --$what|") || die "Cannot get curl-config $what list\n"; |
| + | open(CURLCONFIG, '-|', 'sh', $ARGV[0], "--$what") || die "Cannot get curl-config $what list\n"; |
| while(<CURLCONFIG>) { | |
| chomp; | |
| $_ = lc($_) if($what eq "protocols"); # accept uppercase protocols in curl-config | |
tests/libtest/test1022.pl+1 -1
| @@ -44,7 +44,7 @@ close CURL; | |
| my $curlconfigversion; | |
| # Read the output of curl-config --version/--vernum | |
| - | open(CURLCONFIG, "sh $ARGV[0] --$what|") || die "Cannot get curl-config --$what list\n"; |
| + | open(CURLCONFIG, '-|', 'sh', $ARGV[0], "--$what") || die "Cannot get curl-config --$what list\n"; |
| $_ = <CURLCONFIG>; | |
| chomp; | |
| my $filever=$_; | |
tests/libtest/test307.pl+1 -1
| @@ -30,7 +30,7 @@ if($#ARGV != 0) { | |
| print "Usage: $0 curl-executable\n"; | |
| exit 3; | |
| } | |
| - | if(!open(CURL, "$ARGV[0] -s --engine list|")) { |
| + | if(!open(CURL, '-|', $ARGV[0], '-s', '--engine', 'list')) { |
| print "Cannot get SSL engine list\n"; | |
| exit 2; | |
| } | |
tests/test1275.pl+5 -1
| @@ -28,7 +28,11 @@ use warnings; | |
| my $root=$ARGV[0] || ".."; | |
| - | my @m = `git ls-files -- $root`; |
| + | my @m; |
| + | if(open(O, '-|', 'git', 'ls-files', '--', $root)) { |
| + | push @m, <O>; |
| + | close(O); |
| + | } |
| my $errors = 0; | |
tests/test1707.pl+2 -7
| @@ -32,7 +32,6 @@ use warnings; | |
| my $curl = shift @ARGV; | |
| my $opt = shift @ARGV; | |
| - | my $output = shift @ARGV; |
| my $txt = shift @ARGV; | |
| my $longopt; | |
| @@ -45,14 +44,10 @@ else { | |
| } | |
| # first run the help command | |
| - | system("$curl -h $opt > $output"); |
| - | my @curlout; |
| - | open(O, "<$output"); |
| - | push @curlout, <O>; |
| - | close(O); |
| + | my @curlout; open(O, '-|', $curl, '-h', $opt) || die; push @curlout, <O>; close(O); |
| # figure out the short+long option combo using -h all*/ | |
| - | open(C, "$curl -h all|"); |
| + | open(C, '-|', $curl, '-h', 'all'); |
| if($shortopt) { | |
| while(<C>) { | |
| if(/^ +$opt, ([^ ]*)/) { | |