Page History

...

If $filename begins or ends with |, the preceding < forces it to be treated as a file name rather than a shell command.
This code will not execute a shell command. However, an attacker could cause a program to hang by supplying - as the file name. This is interpreted by open() as reading standard input.

Noncompliant Code Example (

...

<ARGV>)

This noncompliant code example uses the <> <ARGV> operator.

while (<><ARGV>) {
  print ":: $_";
};

This code suffers from the same vulnerability as the first noncompliant code example. The <> <ARGV> operator opens every file provided in the @ARGV array and returns a line from each file. It Unfortunately, it uses the two-argument form of open() to accomplish this. If any element of @ARGV begins or ends with |, it will be interpreted as a shell command and executed. In this manner, the <> operator acts exactly like the two-argument form of open()

Noncompliant Code Example (<>)

This noncompliant code example uses the <> operator.

while (<>) {
  print ":: $_";
};

The <> operator is a synonym for <ARGV>, and has the same behavior, with the same vulnerability.

Noncompliant Code Example (-n)

...