Return to Answer

But even then, it's still dangerous and that's down to the <> operator used by -n/-p.

But even then, it's still dangerous and that's down to the <> operator used whenever any of the -n (sed -n mode), -p (sed mode), -a / -F (awk mode) are used without -i (in-place).

Using -T to turn on taint mode helps to some extent. It will abort the command if such malicious file is encountered.

Using -T to turn on taint mode helps to some extent. It will abort the command if such malicious file is encountered (only for the > and | cases, not < or whitespace though).

Also beware that some characters in some multi-byte character sets (like ǖ in BIG5-HKSCS) end in byte 0x7c, the encoding of |.

$ printf ǖ | iconv -t BIG5-HKSCS | od -tx1 -tc
0000000  88  7c
        210   |
0000002

So in locales using that charset,

 perl -pe '' ./nǖ

Would try to run the ./n\x88 command as perl would not try to interpret that file name in the user's locale!