RE: RE: Warning our Fellow Monks

Taint checking would have fatally crapped out when it discovered that you were attempting to use a piece of a foreign string in a critical operation (opening a file). So yes, it would have been quite sufficient in detecting the problem, but it does nothing to help you fix your script so that it will actually run.

Your best bet is to use tokens in your URL submissions, and then map those tokens to a set of filenames. If that can't be arranged, use a regular expression to "untaint" the data by explicitely declaring permitted characters.

($secure) = ($tainted =~ /(\w+)/);
open(F, "< $secure") or die "$!";   # read only

"../../bin/ls -l /etc|" -> "bin"  (no such file)
[download]

Comment on RE: RE: Warning our Fellow Monks Download Code

Replies are listed 'Best First'.
(Ovid - Duking it out over security) RE(3): Warning our Fellow Monks by Ovid (Cardinal) on Oct 12, 2000 at 00:28 UTC
Fastolfe: you need to check for failure on your regex. Currently, if it fails and if there was a value already in `$1`, it will be passed to $secure. That could be disastrous. If a cracker gets your code and figures out how to pass "../../../bin/some_executable" into the previous backreference, you're back to the original problem. Also, if the filename has a period delimited extension (and many of them do), your regex won't work (e.g. "somefile.txt"). Cheers, Ovid Update: I'm a moron. Fastolfe is right. Read dchetlin's response below. (sniff, sniff) That's what I get for reading his code too fast :( Join the Perlmonks Setiathome Group or just go the the link and check out our stats.	[reply]
RE: (Ovid - Duking it out over security) RE(3): Warning our Fellow Monks by dchetlin (Friar) on Oct 12, 2000 at 03:16 UTC
Here's the REx Fastolfe posted: `($secure) = ($tainted =~ /(\w+)/);` I certainly agree that the success needs to be checked, as there's an `open` being called with `$secure` on the next line, but `$secure` will not be ending up with a previous value of `$1`; if the REx fails, it will simply be undefined. -dlc	[reply] [d/l] [select]


Welcome to the Monastery
	PerlMonks