Beefy Boxes and Bandwidth Generously Provided by pair Networks
There's more than one way to do things
 
PerlMonks  

Re^3: Any security holes?

by Limbomusic (Acolyte)
on Jun 27, 2022 at 20:45 UTC ( [id://11145119]=note: print w/replies, xml ) Need Help??


in reply to Re^2: Any security holes?
in thread Any security holes?

Could I ask for an example of correct escaping?

Replies are listed 'Best First'.
Re^4: Any security holes?
by ikegami (Patriarch) on Jun 27, 2022 at 21:54 UTC

    encode_entities($s) would do

      Thanx - thats also what LanX suggested so my script is now this:
      #!C:\Perl64\site\bin\perl.exe use strict; use warnings; use HTML::Entities; use CGI; my $cgi = CGI->new(); my $nick = $cgi->param('nick'); my $pic = $cgi->param('pic'); my $say = $cgi->param('say'); my $likes = $cgi->param('likes'); my $fav = $cgi->param('fav'); my $car = $cgi->param('car'); my $age = $cgi->param('age'); my $town = $cgi->param('town'); my $drink = $cgi->param('drink'); my $wpage = $cgi->param('wpage'); encode_entities($_) for $nick, $pic, $say, $likes, $fav, $car, $age, $town, $drink, $wp +age; open(my $fh, '>>', 'drivers.html'); print "Content-type:text/html\r\n\r\n"; print $fh "<b>$nick</b><br><img src='$pic' width='250' height='auto' b +order='2'><br><br>Says <b>$say</b><br>Likes <b>$likes</b><br>Favorite + vehicle <b>$fav</b><br> Real life car/vehicle <b>$car</b><br>Age <b> +$age</b><br>Hometown <b>$town</b><br>Favorite drink <b>$drink</b><br> +<b><a href='$wpage'>$wpage</a></b><HR color=#008000 SIZE=2>\n"; print "<html><head><meta http-equiv = 'refresh' content = '0; url = dr +ivers.html' /></head>"; close $fh;
      I also tried using -T (taint) after the shebang line but then I just get 500 Internal error - any idea why?
        I also tried using -T (taint) after the shebang line but then I just get 500 Internal error - any idea why?

        Your script attempts to write tainted data to the filesystem. Running in taint mode protects you from doing this which is a very good reason to run in taint mode. See your web server's error log for more detail.

        Update: As in the replies, there is no reason why your script as posted would not run under taint mode. I too have just tried it and it works fine.


        🦛

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://11145119]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others musing on the Monastery: (5)
As of 2024-04-20 01:07 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found