From: Ian Ward Comfort <icomfort@stanford.edu>
Date: Mon, 07 Jun 2010 06:01:00 GMT
Subject: Re: [PATCH] Put quotes around branch names to prevent special characters from being interpreted by the shell.
Message-ID: <EE9EE2D7-B15C-4858-A4C1-B045FD5AC6BA@stanford.edu>
In-Reply-To: <AANLkTik7PV-2u24UF78U6rtuffw4XUGS1F4hD2_ElrZZ@mail.gmail.com>

On 6 Jun 2010, at 10:48 PM, Ævar Arnfjörð Bjarmason wrote:
> On Mon, Jun 7, 2010 at 05:10, Jay Soffian <jaysoffian@gmail.com>  
> wrote:
>> BTW, quotemeta is technically intended for use with regular  
>> expressions, isn't it?
>
> Yes, it's completely insecure to use it for shell interpolation.
>
> In Perl it's best to use the list form of system() so that the  
> command will escape things for you automatically.

Passing a list to system() actually ensures that Perl will call execvp  
directly, instead of looking for metacharacters and possibly invoking  
the system shell.  (But this is getting a little OT; sorry.)

-- 
Ian Ward Comfort <icomfort@stanford.edu>
Systems Team Lead, Academic Computing Services, Stanford University