[tpm] Breaking a string up into hash keys

[Shlomi Fish]

Hi Antonio,

On Sat, 13 Apr 2013 10:33:27 -0400
Antonio Sun <antoniosun at lavabit.com> wrote:

> On Sat, Apr 13, 2013 at 1:29 AM, Digimer <lists at alteeve.ca> wrote:
> 
> > Hi all,
> >
> >   I've got a rather large, random-depth hash. ie:
> >
> > $conf->{foo}{bar} = "a";
> > $conf->{baz} = "1";
> > $conf->{this}{and}{the}{other}**{thing} = "what?";
> >
> >   And so on. The number of hash keys can be quite varied, depending on the
> > use.
> >
> >   So now I want to be able to take a string that is in the format:
> >
> > foo::bar
> > baz
> > this::and::the::other::thing
> >
> >   Split on the :: and use that to pull the value out of the hash.
> >
> 
> 
> Use eval.
> 
> It's pretty simple to transform "this::and::the::other::thing"
> into {this}{and}{the}{other}{thing}, and the next thing is to pull the
> value out of the hash:
> 
> 
> $ perl -d -e 0
> 
> DB<5> eval '$conf->{foo}{bar} = "a";'
> 
>   DB<6> p $conf->{foo}{bar}
> a
> 

Please avoid using string eval in that case, because it is potentially
an extreme security risk. What if someone does:

	my $s = q{system("rm -fr ~");}

	eval $s;

See:

http://perl-begin.org/tutorials/bad-elements/#string-eval

Regards,

	Shlomi Fish

-- 
-----------------------------------------------------------------
Shlomi Fish       http://www.shlomifish.org/
"Humanity" - Parody of Modern Life - http://shlom.in/humanity

An apple a day keeps the doctor away.
Two apples a day will keep two doctors away.
    — one of Shlomi Fish’s relatives

Please reply to list if it's a mailing list post - http://shlom.in/reply .