earthboundmisfit has asked for the wisdom of the Perl Monks concerning the following question:
In reading over the node, Executing a function on submit, I realized that one of my coding practices has some potential security risks.
Instead of retrieving the value of parameter values on an as-needed basis, I quite typically dump the entire contents of param() to scalars, as in:
So any form field in the HTML file automatically becomes a Perl var in the cgi script when the form is submitted.use strict; use warnings; use CGI; my $q = new CGI; @names = $q->param; foreach $name(@names){ $$name=$q->param($name); #print $name, ': ', $$name, '<BR>'; }
After spending some time on this site, it occurs to me that some unscrupulous but savvy user could quite easily break a program by "hijacking" my form, i.e. downloading a local copy and modifying the field names in the form and changing the ACTION statement to a fully qualified URI.
How ruined would my day be if the following were submitted?:
I understand that a lot depends on the particulars of my script, but my generalized question is is my concern warranted or is there some sort of built in security measure in CGI.pm to handle reserved variable names? If my concern is warranted, has anyone out there come up with a bullet proof way of dealing with this?<FORM METHOD=POST ACTION="http://mydomain.com/cgi-bin/search.cgi"> <INPUT TYPE='text' name='a'> <INPUT TYPE='text' name='b'> <INPUT TYPE='text' name='/'> <INPUT TYPE='text' name='\'> <INPUT TYPE='text' name='!'> <INPUT TYPE='text' name='_'> </FORM>
I've read over the CGI docs and can't find anything related to this topic. (??)
|
---|
Replies are listed 'Best First'. | |
---|---|
Re: Web form security
by Masem (Monsignor) on Jul 30, 2001 at 17:18 UTC | |
Re: Web form security
by tachyon (Chancellor) on Jul 30, 2001 at 17:39 UTC | |
by Masem (Monsignor) on Jul 30, 2001 at 18:52 UTC | |
Re: Web form security
by premchai21 (Curate) on Jul 30, 2001 at 18:36 UTC | |
by earthboundmisfit (Chaplain) on Jul 31, 2001 at 00:32 UTC | |
by premchai21 (Curate) on Jul 31, 2001 at 07:06 UTC | |
importing CGI parameters (boo)
by boo_radley (Parson) on Jul 30, 2001 at 18:59 UTC | |
(ichimunki) Re: Web form security
by ichimunki (Priest) on Jul 30, 2001 at 18:51 UTC | |
Re: Web form security
by Beatnik (Parson) on Jul 30, 2001 at 17:47 UTC | |
Re: Web form security
by jlongino (Parson) on Jul 30, 2001 at 23:38 UTC |
Back to
Seekers of Perl Wisdom