Page History

Perl provides several functions for list manipulation. For instance, the map() function takes an expression or block, applies it to each element in a list, and returns the list of mapped elements. If it is given a block, the block is executed with $_ assigned to each element of the list in turn. The perlfunc manpage adds:

Note that $_ is an alias to the list value, so it can be used to modify the elements of the LIST. While this is useful and supported, it can cause bizarre results if the elements of LIST are not variables. Using a regular "foreach" loop for this purpose would be clearer in most cases.

...

open( PASSWD, "<", "/etc/passwd"); or croak "error opening /etc/passwd: stopped"
my @users = <PASSWD>;
my @shell_users = grep +(s|/bin/sh||), @users;
foreach my $user (@shell_users) {
  print "Shell User: $user";
}

However, because the grep() block removes /bin/sh from any input line that contains it, it modifies the @users list so that no user has /bin/sh!

Compliant Solution (grep())

This compliant solution does the same thing but does not modify the the @users array array.

open( PASSWD, "<", "/etc/passwd"); or croak "error opening /etc/passwd: stopped"
my @users = <PASSWD>;
my @shell_users = grep +(m|/bin/sh|), @users;
foreach my $user (@shell_users) {
  $user =~ s|/bin/sh||;
  print "Shell User: $user";
}

...

Compliant Solution (apply())

This compliant solution does the same thing but uses List::MoreUtils::apply(), which guarantees not to modify its input list.

open( PASSWD, "<", "/etc/passwd") or croak "error opening /etc/passwd: stopped"
my @users = <PASSWD>;
my @shell_users = List::MoreUtils::apply { s|/bin/sh|| } @users;
foreach my $user (@shell_users) {
  print "Shell User: $user";
}

Risk Assessment

Failure to handle error codes or other values returned by functions can lead to incorrect program flow and violations of data integrity.

Automated Detection

Bibliography

...

...

...

...

...

...

Image Modified Image Modified Image Modified