[perl #33173] shellwords.pl and tainting

From: perl-5.8.0@ton.iguana.be (via RT) <perlbug-followup@perl.org>
Message-ID: <rt-3.0.11-33173-103504.3.54366755060383@perl.org>

p4raw-id: //depot/perl@23681

diff --git a/lib/shellwords.pl b/lib/shellwords.pl
index ca7dc7e..124c29a 100644 (file)
--- a/lib/shellwords.pl
+++ b/lib/shellwords.pl
@@ -2,48 +2,46 @@
 ;#
 ;# Usage:
 ;#     require 'shellwords.pl';
-;#     @words = &shellwords($line);
+;#     @words = shellwords($line);
 ;#     or
-;#     @words = &shellwords(@lines);
+;#     @words = shellwords(@lines);
 ;#     or
-;#     @words = &shellwords;           # defaults to $_ (and clobbers it)
+;#     @words = shellwords();          # defaults to $_ (and clobbers it)
 
 sub shellwords {
-    package shellwords;
-    local($_) = join('', @_) if @_;
-    local(@words,$snippet,$field);
+    local *_ = \join('', @_) if @_;
+    my (@words, $snippet);
 
-    s/^\s+//;
+    s/\A\s+//;
     while ($_ ne '') {
-       $field = '';
+       my $field = substr($_, 0, 0);   # leave results tainted
        for (;;) {
-           use re 'taint'; # leave strings tainted
-           if (s/^"(([^"\\]|\\.)*)"//) {
-               ($snippet = $1) =~ s#\\(.)#$1#g;
+           if (s/\A"(([^"\\]|\\.)*)"//s) {
+               ($snippet = $1) =~ s#\\(.)#$1#sg;
            }
-           elsif (/^"/) {
+           elsif (/\A"/) {
                die "Unmatched double quote: $_\n";
            }
-           elsif (s/^'(([^'\\]|\\.)*)'//) {
-               ($snippet = $1) =~ s#\\(.)#$1#g;
+           elsif (s/\A'(([^'\\]|\\.)*)'//s) {
+               ($snippet = $1) =~ s#\\(.)#$1#sg;
            }
-           elsif (/^'/) {
+           elsif (/\A'/) {
                die "Unmatched single quote: $_\n";
            }
-           elsif (s/^\\(.)//) {
+           elsif (s/\A\\(.)//s) {
                $snippet = $1;
            }
-           elsif (s/^([^\s\\'"]+)//) {
+           elsif (s/\A([^\s\\'"]+)//) {
                $snippet = $1;
            }
            else {
-               s/^\s+//;
+               s/\A\s+//;
                last;
            }
            $field .= $snippet;
        }
        push(@words, $field);
     }
-    @words;
+    return @words;
 }
 1;