Safely parsing parameters


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Safely parsing parameters
# 1  
Old 03-18-2010
If you you run your parameters through awk or perl, you can also break them apart if you do not want to use eval.

Code:
perl -nle 'BEGIN {map {print} @ARGV; exit;}' root=/dev/sda3 noacpi foo "Baz mumble" `echo muahahahaha >&2`
muahahahaha
root=/dev/sda3
noacpi
foo
Baz mumble

Note that the backticks you used in your example are being executed prior to being fed to the perl script. Whatever the user can execute using backticks on your command line, he would have the privileges to execute directly before he executed your script.

The security "hole" only exists if you elevate privileges in your script and then have a way to execute arbitrary code, no?

If you are still concerned, perl or awk can split arbitrary strings just like the shell inside of the interpreter, but this is not entirely trivial.

You would just need to decide which expansions you would want to support and which not:

Shell Expansions - Bash Reference Manual
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. Red Hat

Can all files under /tmp be safely removed

I wanted to know whether all files under /tmp can be safely removed. I guess that /tmp may also have temporary files for applications currently being worked on, so at the most those applications may just shut down. I hope that my question is clear whether all files under /tmp can be safely... (5 Replies)
Discussion started by: RHCE
5 Replies

2. Solaris

need to safely reboot to cdrom

I am using: reboot -- cdrom However I'm afraid of causing file system errors/corruption. I've seen many threads say that init 6 is safer, but I need to get to CDROM. Is there a command that is as safe as init, but can boot to cdrom, or should I not worry so much about the reboot... (5 Replies)
Discussion started by: lcoreyl
5 Replies

3. Solaris

How to remove soft link safely

Greetings, I need some help performing a system admin function that I have been tasked with. The request seems simple enough, but my feeling is that it might be more complicated than it seems. Here is what i've been tasked with: SunOS 5.10 Generic_142900-15 sun4u sparc SUNW,SPARC-Enterprise... (3 Replies)
Discussion started by: Harleyrci
3 Replies

4. Programming

Value changed when parsing parameters

I get a strange problem here, and ask for help. (gdb) 28 set_file_bit( file, bytePos, bitPos, argv ); (gdb) p argv $3 = 0xbfffef5c "00" (gdb) s set_file_bit (file=0x804b008, bytePos=2, bitPos=2, binary=0x80490e5 "11") at util/file.c:112 ... (2 Replies)
Discussion started by: 915086731
2 Replies

5. Shell Programming and Scripting

How to safely rm/mv files/directory

Hi all, Am writing a script that does a rm/mv if a file exist, however, in one scenario, one of the variables which is supposed to a variable for a directory is undefined/blank so instead of the variable resolving to /tmp/logfile.dmp, it resolves instead to / so the rm translates to a rm /... (2 Replies)
Discussion started by: newbie_01
2 Replies

6. Shell Programming and Scripting

Help parsing job script input parameters

I have a job script that runs with input parms from the command line. job.sh -p parm1_parm2_parm3_parm4_file_1.dat The parms are separated by _ The last parm is a file name and can have an _ in the name. I currently use the following commands to extract the parms parm1=`eval echo... (3 Replies)
Discussion started by: jclanc8
3 Replies

7. UNIX for Advanced & Expert Users

Can I safely kill vdump?

Sceduled backups with vdump have been delayed as a mounted system had crashed while I was away for 2 weeks. Now there are 5 simultaneous vdumps running very slowly. The full system backup usually takes a whole weekend. Can I safely kill these? (I will have to live without a backup untill next... (4 Replies)
Discussion started by: nickt
4 Replies

8. Shell Programming and Scripting

Help with parsing parameters

Hi:- I need to parse a script 3 parameters (file, subject and email address). This is what I currently have: allargs=$* argcount=`echo $allargs | awk -F: '{ print NF }' ` # Total Number of arguments pdffile=`echo $allargs | awk -F: '{ print $1 }' ` # PDF/binary file to be encoded... (4 Replies)
Discussion started by: janet
4 Replies

9. Shell Programming and Scripting

Parsing Parameters

How do you pass parameters over to another script and run the receiving script? . Here is an example of what I am talking about. for x in `cat Allx` do su myaccount -c "/temp/scripts/temp_script $x" > /dev/null 2>$1 $ done I was expecting the tem_script to be... (1 Reply)
Discussion started by: odogbolu98
1 Replies
Login or Register to Ask a Question
Graphics::Primitive::Component(3pm)			User Contributed Perl Documentation		       Graphics::Primitive::Component(3pm)

NAME
Graphics::Primitive::Component - Base graphical unit DESCRIPTION
A Component is an entity with a graphical representation. SYNOPSIS
my $c = Graphics::Primitive::Component->new({ origin => Geometry::Primitive::Point->new({ x => $x, y => $y }), width => 500, height => 350 }); LIFECYCLE
prepare Most components do the majority of their setup in the prepare. The goal of prepare is to establish it's minimum height and width so that it can be properly positioned by a layout manager. $driver->prepare($comp); layout This is not a method of Component, but a phase introduced by the use of Layout::Manager. If the component is a container then each of it's child components (even the containers) will be positioned according to the minimum height and width determined during prepare. Different layout manager implementations have different rules, so consult the documentation for each for details. After this phase has completed the origin, height and width should be set for all components. $lm->do_layout($comp); finalize This final phase provides and opportunity for the component to do any final changes to it's internals before being passed to a driver for drawing. An example might be a component that draws a fleuron at it's extremities. Since the final height and width isn't known until this phase, it was impossible for it to position these internal components until now. It may even defer creation of this components until now. It is not ok to defer all action to the finalize phase. If you do not establish a minimum hieght and width during prepare then the layout manager may not provide you with enough space to draw. $driver->finalize($comp); draw Handled by Graphics::Primitive::Driver. $driver->draw($comp); METHODS
Constructor new Creates a new Component. Instance Methods background_color Set this component's background color. border Set this component's border, which should be an instance of Border. callback Optional callback that is fired at the beginning of the "finalize" phase. This allows you to add some sort of custom code that can modify the component just before it is rendered. The only argument is the component itself. Note that changing the position or the dimensions of the component will not re-layout the scene. You may have weird results of you manipulate the component's dimensions here. class Set/Get this component's class, which is an abitrary string. Graphics::Primitive has no internal use for this attribute but provides it for outside use. color Set this component's foreground color. fire_callback Method to execute this component's "callback". get_tree Get a tree for this component. Since components are -- by definiton -- leaf nodes, this tree will only have the one member at it's root. has_callback Predicate that tells if this component has a "callback". height Set this component's height. inside_bounding_box Returns a Rectangle that defines the edges of the 'inside' box for this component. This box is relative to the origin of the component. inside_height Get the height available in this container after taking away space for padding, margin and borders. inside_width Get the width available in this container after taking away space for padding, margin and borders. margins Set this component's margins, which should be an instance of Insets. Margins are the space outside the component's bounding box, as in CSS. The margins should be outside the border. maximum_height Set/Get this component's maximum height. Used to inform a layout manager. maximum_width Set/Get this component's maximum width. Used to inform a layout manager. minimum_height Set/Get this component's minimum height. Used to inform a layout manager. minimum_inside_height Get the minimum height available in this container after taking away space for padding, margin and borders. minimum_inside_width Get the minimum width available in this container after taking away space for padding, margin and borders. minimum_width Set/Get this component's minimum width. Used to inform a layout manager. name Set this component's name. This is not required, but may inform consumers of a component. Pay attention to that library's documentation. origin Set/Get the origin point for this component. outside_height Get the height consumed by padding, margin and borders. outside_width Get the width consumed by padding, margin and borders. finalize Method provided to give component one last opportunity to put it's contents into the provided space. Called after prepare. padding Set this component's padding, which should be an instance of Insets. Padding is the space inside the component's bounding box, as in CSS. This padding should be between the border and the component's content. page If true then this component represents stand-alone page. This informs the driver that this component (and any children) are to be renderered on a single surface. This only really makes sense in formats that have pages such as PDF of PostScript. prepare Method to prepare this component for drawing. This is an empty sub and is meant to be overridden by a specific implementation. preferred_height Set/Get this component's preferred height. Used to inform a layout manager. preferred_width Set/Get this component's preferred width. Used to inform a layout manager. to_string Get a string representation of this component in the form of: $name $x,$y ($widthx$height) visible Set/Get this component's visible flag. width Set/Get this component's width. AUTHOR
Cory Watson, "<gphat@cpan.org>" BUGS
Please report any bugs or feature requests to "bug-geometry-primitive at rt.cpan.org", or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Geometry-Primitive <http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Geometry-Primitive>. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes. COPYRIGHT &; LICENSE Copyright 2008-2009 by Cory G Watson. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.12.3 2011-06-02 Graphics::Primitive::Component(3pm)