我试图了解this secure coding example中发生的事情。
我重写了代码以更好地支持我的问题:
#!/usr/bin/perl
use warnings;
use strict;
use Data::Dumper;
my $prompt = 'name%n'; # The bad coding practice from the exercise.
my $password = 'badpass';
my $is_ok = ($password eq "goodpass");
print Dumper( $is_ok );
print "\n$prompt: Password ok? $is_ok\n";
print Dumper( $is_ok );
$is_ok = ($password eq "goodpass");
printf "\n$prompt: Password ok? %d\n" , $is_ok;
print Dumper( $is_ok );
当我执行脚本时,输出如下:
$ ./authenticate.pl
$VAR1 = '';
name%n: Password ok?
$VAR1 = '';
Missing argument in printf at ./authenticate.pl line 19.
name: Password ok? 0
$VAR1 = 5;
显然$is_ok
被%n
$prompt
消耗,%d
离开$is_ok
没有匹配的参数。但我不希望$is_ok
改变值,为什么5
被printf语句设置为{{1}}?
答案 0 :(得分:6)
因为那是%n
的作用。
%n special: *stores* the number of characters output so far into the next argument in the parameter list
解决方案是:
printf "\n%s: Password ok? %d\n", $prompt, $is_ok;