Okay, I remember this talk, I'll try to write pseudo code for one of the real life bugs that nobody saw for 20 years (in Bugzilla that is, not some small script nobody knows).
$user = new User({
userid => $foo,
role => "user",
username => cgi->param("username"),
password => bcrypt(cgi->param("password"))
});
If you're seriously telling me you instantly spot the bug (if that were real perl, i don't know perl) without having seen the talk before, then congratulations, nobody else did, please start auditing perl software.
For anyone that didn't see the talk, no the bug isn't SQL injection or something like that (though that'd likely be possible too, watch the talk).
If you pass ?username=foo&username=bar then cgi.param("username") will actually return a list ("foo", "bar").
Now say you pass a list of three elements ?username=foo&username=role&username=admin ... yes seriously. It'll add the list into the hash and use every %2 element as key and the other as value. allowing you to overwrite stuff in hashes.
Of course, all of this is documented. But that doesn't make it not terrible.
PS: I don't hate perl. Perl -e is still very handy sometimes.
For anyone that didn't see the talk, no the bug isn't SQL injection or something like that (though that'd likely be possible too, watch the talk).
If you pass ?username=foo&username=bar then cgi.param("username") will actually return a list ("foo", "bar").
Now say you pass a list of three elements ?username=foo&username=role&username=admin ... yes seriously. It'll add the list into the hash and use every %2 element as key and the other as value. allowing you to overwrite stuff in hashes.
Of course, all of this is documented. But that doesn't make it not terrible.
PS: I don't hate perl. Perl -e is still very handy sometimes.