(perl #134046) list form system/exec/pipe open limits on Win32

diff --git a/pod/perlport.pod b/pod/perlport.pod
index 5ad2ffc..b870c23 100644 (file)
--- a/pod/perlport.pod
+++ b/pod/perlport.pod
@@ -1647,6 +1647,11 @@ Invokes VMS debugger.
 C<exec LIST> without the use of indirect object syntax (C<exec PROGRAM LIST>)
 may fall back to trying the shell if the first C<spawn()> fails.
 
+Note that the list form of exec() is emulated since the Win32 API
+CreateProcess() accepts a simple string rather than an array of
+command-line arguments.  This may have security implications for your
+code.
+
 (SunOS, Solaris, HP-UX)
 Does not automatically flush output handles on some platforms.
 
@@ -1959,13 +1964,19 @@ Not implemented.
 
 =item open
 
-(Win32, S<RISC OS>)
+(S<RISC OS>)
 Open modes C<|-> and C<-|> are unsupported.
 
 (SunOS, Solaris, HP-UX)
 Opening a process does not automatically flush output handles on some
 platforms.
 
+(Win32)
+Both of modes C<|-> and C<-|> are supported, but the list form is
+emulated since the Win32 API CreateProcess() accepts a simple string
+rather than an array of arguments.  This may have security
+implications for your code.
+
 =item readlink
 
 (Win32, VMS, S<RISC OS>)
@@ -2124,6 +2135,11 @@ L<C<$?>|perlvar/$?> to C<<< 255 << 8 >>>.  L<C<$?>|perlvar/$?> is set in a
 way compatible with Unix (i.e. the exit status of the subprocess is
 obtained by C<<< $? >> 8 >>>, as described in the documentation).
 
+Note that the list form of system() is emulated since the Win32 API
+CreateProcess() accepts a simple string rather than an array of
+command-line arguments.  This may have security implications for your
+code.
+
 (S<RISC OS>)
 There is no shell to process metacharacters, and the native standard is
 to pass a command line terminated by "\n" "\r" or "\0" to the spawned