Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl-Sensitive Sunglasses
 
PerlMonks  

comment on

( #3333=superdoc: print w/replies, xml ) Need Help??
You may want to check out File::Spec, which has a set of methods that may be used to sanitize a given path or filename, if I recall correctly...

Update: Having just peeked at the docs, it looks like the $convertedpath=File::Spec->abs2rel($path,$base) method might help, where $path is the path to be checked and $base is the highest level you want to allow access to within the filesystem. E.g. constructions such as $path="/allowed/../../notallowed" should return "../../notallowed" if $base=="/allowed". You can then check for a match with /^\.\./ and discard dubious paths.

Update2: Now that I stop to think about it, you could then use the converse function, File::Spec->rel2abs($convertedpath,$base) to get a properly qualified, cleaned up path ( i.e. no /../../). Note that a physical check on the filesystem is not (usually, depending on OS) done during these operations.

Update^3: In what could perhaps be viewed as irony (or perhaps just plain inconvenience), it looks like you may have to move to the Linux phase anyway to implement this idea, as it doesn't look like the File::Spec::Win32 module supports these methods (File::Spec::Unix does, of course).

HTH,
Tim


In reply to Re: Controlling Inputted Paths in a CGI Script by tfrayner
in thread Controlling Inputted Paths in a CGI Script by ajt

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post; it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.
  • Log In?
    Username:
    Password:

    What's my password?
    Create A New User
    Chatterbox?
    and the web crawler heard nothing...

    How do I use this? | Other CB clients
    Other Users?
    Others lurking in the Monastery: (6)
    As of 2020-07-03 12:58 GMT
    Sections?
    Information?
    Find Nodes?
    Leftovers?
      Voting Booth?

      No recent polls found

      Notices?