From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Mon, 07 Jun 2010 05:48:11 GMT
Subject: Re: [PATCH] Put quotes around branch names to prevent special characters from being interpreted by the shell.
Message-ID: <AANLkTik7PV-2u24UF78U6rtuffw4XUGS1F4hD2_ElrZZ@mail.gmail.com>
In-Reply-To: <AANLkTinZc1jiBmTJRsJXDe7A4ZAe001zJIWILGKQ8YoA@mail.gmail.com>

On Mon, Jun 7, 2010 at 05:10, Jay Soffian <jaysoffian@gmail.com> wrote:
> BTW, quotemeta is technically intended for use with regular
> expressions, isn't it?

Yes, it's completely insecure to use it for shell interpolation.

In Perl it's best to use the list form of system() so that the command
will escape things for you automatically.