Re: Trojan Horse? (taint mode)

Here is the relevant portion of the text from page 13: (I believe this is fair use)

Trojan horses
While we are talking about obfuscation, it is worth talking about a very insidious way of including executable code within strings. Normally, when Perl sees a string such as "$a", it does variable interpolation. But you now know that "a" can be replaced by a block as long as it returns a reference to a scalar, so something like this is perfectly acceptable, even within a string:
print "${foo()}";
[download]
Replace foo() by system ('/bin/rm *') and you have an unpleasant Trojan Horse.
print "${system('/bin/rm *')}"
[download]
Perl treats it like any other function and trusts system to return a reference to a scalar. The parameters given to system do their damage before Perl has a chance to figure out that system doesn't return a scalar reference.
Moral of the story: Be very careful of strings that you get from untrusted sources. Use the taint-mode option (invoke Perl as perl -T) or the Safe module that comes with the Perl distribution. Please see the Perl documentation for taing checking, and see the index for som pointers to the Safe module.

At the very best this is correct but unclear... at the worst it is just plain wrong. The above implies (but doesn't exactly state) that this would wreak havoc on your machine:

$a = q|{system('/bin/rm -rf *')}|;
print "$a";
[download]

but, as has been stated above, the output of this snippet is simply the value of $a.... no external commands are executed.

Unless I'm overlooking something, this looks like an Errata to me.

-Blake

Comment on Re: Trojan Horse? (taint mode) Select or Download Code

Replies are listed 'Best First'.
Re: Re: Trojan Horse? (taint mode) by cfreak (Chaplain) on Nov 26, 2001 at 20:42 UTC
I think its very clear... I decided to try it as the author stated above. I used echo because well - I like my system the way it is. And its a good thing I did too because the command executed. This is what I have: `#!/usr/bin/perl $a ="${system(\"echo 'hello from system'\")}\n"; print "$a";` [download] And this is the output: `hello from system stupid.pl` [download] I think this is what the author is talking about. Now when I use the q or qq it responds as you said so I guess that perl treats qq differently than an actual double quote. Something I didn't know. Interestingly enough it prints the name of the script out as well when this command executes... not sure why.	[reply] [d/l] [select]
Re: Re: Re: Trojan Horse? (taint mode) by blakem (Monsignor) on Nov 26, 2001 at 23:35 UTC
I see no difference in the behavior of the following two lines: `$a = qq\|${system("echo 'hello from system'")}\n\|; $a = "${system(\"echo 'hello from system'\")}\n";` [download] They both execute the 'echo' command which sends a message to your terminal and returns 0. My perl (5.00503 and 5.6.1 on unix) then complains that 0 is not a scalar ref and dies. Apparently your perl is casting the return value of 0 into a scalar ref to 0, and $a is assigned the value of $0, which happens to be the name of the script. The book seems to imply that this behavior emulates what would happen if $a had come from user input. Fortunately that is not the case. If $a had come from STDIN, none of the above caveats would apply. Try it: `#!/usr/bin/perl -wT use strict; my $a = <STDIN>; chomp($a); print "$a";` [download] </code> -Blake	[reply] [d/l] [select]
Re:(lots of re:)Trojan Horse? (taint mode) by cfreak (Chaplain) on Nov 27, 2001 at 01:32 UTC
Opps must have foobared my test. You are correct `$a = qq\|${system("echo 'hello from system'")}\n\|; $a = "${system(\"echo 'hello from system'\")}\n";` [download] do the same thing. Some how I had your example simply printing the string... hmmm Anyway I read the author to mean to not do this: `$a = <stdin>; print "Some string with ${$a}";` [download] But as you stated I'm finding that doesn't work, which is very strange to me. It seems as though it should, and there could be really cool uses for it. That said, to get somewhat back on the orginal topic using taint mode is still a good idea, especially in CGI scripts. The trick is to learn what should be untainted and what doesn't have to be.	[reply] [d/l] [select]


We don't bite newbies here... much
	PerlMonks