Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris

Re: securing code

by damian1301 (Curate)
on Aug 11, 2001 at 22:46 UTC ( [id://104171] : note . print w/replies, xml ) Need Help??

in reply to securing code

You should always use Taint checking when dealing with CGI scripts or scripts that interact with the server. Plus, its just a good habit to get into anyway. Taint checking doesn't allow any information from outside of the Perl program (parameters, ENV vars, etc) to be used in certain functions or in system calls. Example: This will die under -T:
#!/usr/bin/perl -wT my $paco = shift; # get first argument from @ARGV, or the command line +. unlink $paco;
After running this, even without anything in @ARGV, it will give you an error like:
Insecure dependency in unlink while running with -T switch at +line 3
Now that you (partially) understand taint checking, always be sure to add warnings as well. You do this by just adding the -w flag to your shebang like so:
#!/usr/bin/perl -wT
Now that script has warnings and taint checking activated.

What warnings does is make it easier to debug your program. If you are above 5.006 then you can just add use warnings; to your script.

Ok, now, another problem with your script is taht you dont use strict;. There are many articles on it, so here are some perllib and

Another problem with your script is that you don't check to see if your program opened up one of the many files correctly. You also don't check to see if they close correctly. You can help yourself and your program by adding this to your open and close calls:
open(FILE,$file) || die "Could not open $file because: $!"; close(FILE) || die "Could not close $file because: $!";
This way it will check to see if they did what they were supposed to do and save you some problems later.

$_.=($=+(6<<1));print(chr(my$a=$_));$^H=$_+$_;$_=$^H; print chr($_-39); # Easy but its ok.