|Syntactic Confectionery Delight
Preventing DOS attacks with CGI.pmby Ovid (Cardinal)
|on Aug 10, 2001 at 01:10 UTC
Ovid has asked for the wisdom of the Perl Monks concerning the following question:
If you've been working with CGI.pm for any length of time, you know that it allows uploads by default and does not have a maximum post size. Since it saves the uploads as a temp file, someone can simply upload enough data to fill up your hard drive to initiate a DOS attack. To prevent this, we're regularly warned to include the following two lines at the top of our CGI scripts:
As long as those are their before you instantiate a CGI object (or before you access param and related CGI functions with the function oriented interface), you have pretty safely plugged this problem. However, most CGI scripts don't have these lines of code. Some suggest changing these settings directly in CGI.pm. I dislike this for two reasons:
So, my thought was to write a CGI::Safe module that inherits from CGI.pm. It will establish the defaults for those variables and require virtually no code changes. Further, no existing code would be affected. You can also override the defaults established by explicitly stating them in your code or passing them as named arguments to the CGI::Safe constructor. It would work like this:
This would be equivalent to:
Since you can also pass arguments to the CGI constructor, you would pass them like this:
Just a rough hack:
I'm wondering if anyone sees any problems with this approach or if anyone has any suggestions.
Vote for paco!
Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.