In reading over the node, Executing a function on submit, I realized that one of my coding practices has some potential security risks.

Instead of retrieving the value of parameter values on an as-needed basis, I quite typically dump the entire contents of param() to scalars, as in:

use strict;
use warnings;
use CGI;
my $q = new CGI;
@names = $q->param;
foreach $name(@names){
    $$name=$q->param($name);
    #print $name, ': ', $$name, '<BR>';
}
[download]

So any form field in the HTML file automatically becomes a Perl var in the cgi script when the form is submitted.

After spending some time on this site, it occurs to me that some unscrupulous but savvy user could quite easily break a program by "hijacking" my form, i.e. downloading a local copy and modifying the field names in the form and changing the ACTION statement to a fully qualified URI.

How ruined would my day be if the following were submitted?:

<FORM METHOD=POST ACTION="http://mydomain.com/cgi-bin/search.cgi">
<INPUT TYPE='text' name='a'>
<INPUT TYPE='text' name='b'>
<INPUT TYPE='text' name='/'>
<INPUT TYPE='text' name='\'>
<INPUT TYPE='text' name='!'>
<INPUT TYPE='text' name='_'>
</FORM>
[download]

I understand that a lot depends on the particulars of my script, but my generalized question is is my concern warranted or is there some sort of built in security measure in CGI.pm to handle reserved variable names? If my concern is warranted, has anyone out there come up with a bullet proof way of dealing with this?

I've read over the CGI docs and can't find anything related to this topic. (??)

---

---

• Are you posting in the right place? Check out Where do I post X? to know for sure.
• Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:

  <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>

• Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
• Want more info? How to link or How to display code and escape characters are good places to start.