Re: flashplugin-nonfree get-upstream-version.pl security concern

[Ansgar Burchardt <ansgar@debian.org>]

Mike Mestnik <cheako+debian-security@mikemestnik.net> writes:
> The link($1) can't contain a ", but a few others(I.E ') should be added
> to this list and use...
> open INPUT, "wget --user-agent=\"$user_agent\" -qO - \"$url\" |" or die;
> or
> open INPUT, "wget --user-agent='$user_agent' -qO - '$url' |" or die;

Using the three-or-more argument form of open is better:

  open INPUT, "-|", "wget", "--user-agent=$user_agent", "-qO", "-", $url
      or die;

This avoids using the shell (unless there's only one argument, see
perldoc -f open for that case).  Even in this case one should make sure
that $url is sane and doesn't for example start with a dash like
options.

It's also possible to use (for example) LWP::UserAgent here.

Ansgar