Question

Here is what I have-
A CGI script on server A gets the parameters entered in a webform, creates a remote ssh command that calls another perl file on server B and passes all parameters as arguments to the ash command. Perl file on server B parses arguments n operates thereafter.

Now since I won’t have all parameters populated at all times, I am passing a character such as “=” appended to each parameter from CGI on server A and before processing on Server B, I chop that last character which is an “=”.

However, this fails for a parameter that can have space. To counter this, I can enclose each parameter within ///” (basically a slash to escape ” and then a slash to escape the other slash) before I append the “=”(which probably can be discarded once I enclose each param anyways), but is this the best way to do what I want to achieve?

Answer 1

Rather than calling the command and reading its output, I’d suggest using IPC::Open2 or possibly IPC::Open3 and using your process B as a filter: write in, read out. At this point, you completely eliminate the shell. And, in my experience, eliminating the shell is always a good thing.

And then, to make things really simple, you run the command via IPC::Open[23], write serialised data to it (via JSON or Storable), close the write pipe (so the other side gets eof), and wait for the data. At the other end, read stdin, deserialise it, use it, and serialise your return data again. Back at the CGI server, deserialise the data you received, and away you go. This also works really well if you need to do double or triple bouncing (ssh through one machine to ssh to another).

It is possible to put in enough quotes to get it to work the way you want. It’s moderately painful. However, here are some hints in that direction. First, find something on CPAN which handles the quoting for you. String::ShellQuote might work. Second, avoid the shell as much as possible. That is, instead of using open my $pipe, "ssh $server '$cmd' |", use open my $pipe, '-|', 'ssh', $server, $cmd. This will avoid the local shell. And that reduces the number of times you have to worry about quoting anything. But you will have to re-quote everything every time you do another bounce as each remote machine will still be using the remote shell.