4.4. String::ShellQuote
When invoking raw shell commands (instead of passing a list of command line arguments) one can easily cause a situation where an interpolated string given as argument will place arbitrary code in the shell. If for example we have the following qx call:
my $ls_output = qx/ls '$dir'/;
Then $dir
may be set to "' ; rm -fr ~ ; '
", which will make the shell delete our entire home directory.
To overcome such problems, one should make use of the String-ShellQuote module which provides functions for safely preventing shell-code injection.