Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"
 
PerlMonks  

Re: XSS Protection in cgi application

by stevieb (Canon)
on Nov 03, 2021 at 15:11 UTC ( #11138384=note: print w/replies, xml ) Need Help??


in reply to XSS Protection in cgi application

for whatever reason the boss doesn't want to upgrade to a modern frame work

Come on, let's be honest here. The reason is money. Someone who isn't interested in investing in new, stable technology when the old technology is recommended against, won't be interested in investing much in good security practices either.

That mentality changes quickly when the company is hacked or taken for ransom. At that point though, everyone is scrambling to patch things in an uncontrolled manner, and far more money is spent recklessly than if the original investment in better practices had been made. I have seen this time and time again in my 20+ years in the industry.

PS. From the CGI documentation itself:

"CGI.pm is no longer considered good practice for developing web applications, including quick prototyping and small web scripts. There are far better, cleaner, quicker, easier, safer, more scalable, more extensible, more modern alternatives available at this point in time."

Replies are listed 'Best First'.
Re^2: XSS Protection in cgi application
by Fletch (Chancellor) on Nov 03, 2021 at 15:18 UTC

    I started to comment along similar lines. He's expecting you to make his Model T able to fuel up at a Tesla supercharging station and (of course) needs it by last week . . .

    You should point out to your boss that in order to give an ancient CGI script the protections of a decade-or-so worth of development of security improvements that have gone into more modern frameworks he should expect to need a decade-or-so of work backporting them. There'll probably be some low hanging fruit you can integrate as was mentioned upthread but you'll have to do the work to wire it in yourself (which also means you get fewer eyeballs on it; possibly enough to placate the scanning ones, at least, maybe).

    Of course even if you rewrite using something modern those improvements are just a more solid foundation upon which you can build and you still need to pay attention to best practices while you rebuild. They just make it harder, not impossible, to get your foot under the barrel.

    Edit: The reply below will probably get reaped shortly but you can simulate the experince quite easily.

    The cake is a lie.
    The cake is a lie.
    The cake is a lie.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://11138384]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others scrutinizing the Monastery: (8)
As of 2022-01-24 20:58 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    In 2022, my preferred method to securely store passwords is:












    Results (65 votes). Check out past polls.

    Notices?