Original link: https://blog.frytea.com/archives/630/
I recently encountered a very strange problem when writing a Perl program:
Insecure dependency in unlink while running with -T switch at ../tmpfile.pl line 44.
After inspection, it was found that this is a feature of the Perl language, and using -w or -T at runtime means the “foolproof” flag.
The -T flag means that any value from the outside world (such as reading from a file) is considered a potential threat, and its use in system-related operations such as writing files, executing system commands, etc. is not allowed.
-w has the same effect as use warning , and will throw some useful warning messages, such as using uninitialized variable .
In order to express the problem more clearly, I abstract a simple sample program:
#!/usr/bin/perl -wT use strict; use warnings; use Digest::MD5; my $DIR_PATH="/var/tmp"; my $PREFIX = "somedemotmpfile"; sub make_file { my ($filename) = @_; open my $fh, '>', $filename; print {$fh} "1" . "\n"; print {$fh} "2" . "\n"; print {$fh} "3" . "\n"; close $fh; } sub make_tmpfile { foreach (1..5){ my $tmpfilename = "$DIR_PATH/$PREFIX-" . Digest::MD5::md5_hex($_ . time() . $$); make_file($tmpfilename); } } sub clean_tmpfile { opendir (my $dh, $DIR_PATH) || die "Can not open $DIR_PATH/n"; my @dots=grep { !/^\.+$/ } readdir($dh); closedir($dh); foreach my $file (@dots) { my $afile = "$DIR_PATH/$file"; my $now = time(); if (-e $afile && $afile =~ m/(^.*$PREFIX.*$)/) { #$afile = $1; my $mtime = (stat ($afile))[9]; my $margin = $now - $mtime; print("$afile - Last change: $mtime - now: $now - margin(s): $margin\n"); eval { unlink $afile; }; warn $@ if $@; } } } sub main { make_tmpfile(); clean_tmpfile(); } main();
Execute the program and get the following output:
# perl -T ../tmpfile.pl /var/tmp/somedemotmpfile-e48d74ec998a1462661eb11b7576d7e5 - Last change: 1658904122 - now: 1658904122 - margin(s): 0 Insecure dependency in unlink while running with -T switch at ../tmpfile.pl line 44. /var/tmp/somedemotmpfile-a071ba8e02d34ef2878d7a698a22b93c - Last change: 1658904122 - now: 1658904122 - margin(s): 0 Insecure dependency in unlink while running with -T switch at ../tmpfile.pl line 44. /var/tmp/somedemotmpfile-1a63c4b7965dc50c519e7aa68c8b081a - Last change: 1658904122 - now: 1658904122 - margin(s): 0 Insecure dependency in unlink while running with -T switch at ../tmpfile.pl line 44.
As you can see, when I read some files from the filesystem and try to delete the issues directly, this is blocked with the warning Insecure dependency in unlink while running with -T switch .
In order to eliminate “pollution”, the easiest way is to use the result of strict regular matching and then do the operation. The code is modified as follows:
diff --git a/study_perl/tmpfile.pl b/study_perl/tmpfile.pl index 6520a25..51ef684 100644 --- a/study_perl/tmpfile.pl +++ b/study_perl/tmpfile.pl @@ -36,7 +36,7 @@ sub clean_tmpfile { my $afile = "$DIR_PATH/$file"; my $now = time(); if (-e $afile && $afile =~ m/(^.*$PREFIX.*$)/) { - #$afile = $1; + $afile = $1; my $mtime = (stat ($afile))[9]; my $margin = $now - $mtime; print("$afile - Last change: $mtime - now: $now - margin(s): $margin\n");
Tried running again and got the correct result:
# perl -T ../tmpfile.pl /var/tmp/somedemotmpfile-f036c279daa16297818f6ec2dad9f338 - Last change: 1658904375 - now: 1658904375 - margin(s): 0 /var/tmp/somedemotmpfile-f532d49f86ae1c486ec593c71a073e73 - Last change: 1658904375 - now: 1658904375 - margin(s): 0 /var/tmp/somedemotmpfile-e48d74ec998a1462661eb11b7576d7e5 - Last change: 1658904122 - now: 1658904375 - margin(s): 253 /var/tmp/somedemotmpfile-a071ba8e02d34ef2878d7a698a22b93c - Last change: 1658904122 - now: 1658904375 - margin(s): 253 /var/tmp/somedemotmpfile-a140c4f6095a0431194a91ead41ce605 - Last change: 1658904375 - now: 1658904375 - margin(s): 0 /var/tmp/somedemotmpfile-1a63c4b7965dc50c519e7aa68c8b081a - Last change: 1658904122 - now: 1658904375 - margin(s): 253
The execution is successful and the previous residual files are deleted.
After solving this problem, it is found that Perl’s security features are worth learning. Blocking common security operations at the compilation or interpretation level from being executed allows us to write more secure code.
Even if you don’t write perl code, you can be inspired to write programs in other languages.
references
- What is the significance of -T or -w in #!/usr/bin/perl?
- How do I get a file’s last modified time in Perl?
- How to create a new file in Perl?
- Perl Regular Expression Super Detailed Tutorial
- Perl flow control statement
This article is reproduced from: https://blog.frytea.com/archives/630/
This site is for inclusion only, and the copyright belongs to the original author.