What's the minimal set of characters I need to filter before passing a string to a system call?

Question

Assume that the following Perl code is given:

my $user_supplied_string = &retrieved_from_untrusted_user();
$user_supplied_string =~ s/.../.../g; # filtering done here
my $output = `/path/to/some/command '${user_supplied_string}'`;

The code is clearly insecure, but assume that the only thing that can be changed is the filtering code on line #2.

My question:

• What is the minimal set of characters that needs to be filtered on line #2 to make the above code secure?

Please note:

• Whitelisting is not an option in this case, so please keep your answer focused on what to filter out to make it secure. And more specifically; what is the minimal set of characters to filter out to make it secure? Everything else is off-topic.
• Make sure your answer addresses the question stated ("What is the minimal set of characters that needs to be filtered on line #2 to make the above code secure?"). If your answer does not address that very specific question then don't post. Thanks.

Answer 1

First, given that you are concerned with security, I suggest you look into taint mode. As for the minimal set of characters to allow to be visible to shell, you are better off not letting any characters be seen by the shell:

my $output = do {
    local $/;
    open my $pipe, "-|", "/path/to/some/command", $user_supplied_string
        or die "could not run /path/to/some/command: $!";
    <$pipe>;
};

Answer 2

The set of characters that you allow depend on what the application in that system call is going to do with them. There's the shell special characters, but that's ony one part of the problem. You also have to ensure that the value you give to the command is valid input, and that requires some more work.

See, for instance, my chapter on security in Mastering Perl where I go into the gory details of the problem.

Perhaps you can explain why your problem ties both your hands behind your back and blindfolds you. Your problem isn't technical if those are your constraints.