-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 11 Mar 2002, Michael G Schwern wrote:

>           print "Executing $abs\n" if ($trace >= 2);
>           $val = `$abs -e "require $ver;" 2>&1`;
>
>Using system() might be tricky because we need the result.

Result?  system() gives you the exit status of the process.  You can
capture stdout and stderr with a bit of redirection:
open(OLDERR, '>&STDERR') etc etc.  An example of this is included in
perlfunc(1).

>We could simply escape out whitespace.

Nooo... please don't do that.  It's not possible to find a
cross-platform convention for escape character.  For example, on Win2k's
cmd.exe shell:

% dir c:\program\ files
The system cannot find the file specified.

I also tried using the ^ character which is sometimes an escape
character in DOS/Windows, and that gave very bizarre results.

The only safe and portable way to do this is the multi-argument form of
system().  That is guaranteed to work no matter what the shell gets up
to and no matter what weird characters appear in filenames.  Apart from
ASCII NUL of course :-).

It might be a good idea to make the code taint-clean, that makes sure
you track down all places where weird characters in filenames can cause
problems.  Which is overkill for an ordinary program, but perhaps
necessary for something cross-platform like MakeMaker.

Trying to autoescape filenames is a dubious idea on Unix and downright
impossible across a mix of platforms.  The filenames used internally in
the Perl code should just be stored as strings, without any escaping.
If black magic is required then it's best to isolate it to when the
filenames are used.

- -- 
Ed Avis <[EMAIL PROTECTED]>
Finger for PGP key

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8jPKWIMp73jhGogoRAhpcAJ0R8zoYl945CRUxAp90ASMIJEUAAACgg44Q
R3IXQiCDffS9/D1uMwqnx+o=
=pice
-----END PGP SIGNATURE-----

Reply via email to