#!/usr/bin/perl -T
use strict;
use warnings;
use CGI qw/param/;
use CGI::Carp qw/fatalsToBrowser/;
#__No uploads any more__
$CGI::DISABLE_UPLOADS=1;
#__100kb in case of flooding__
$CGI::POST_MAX=102_400;
#__in case for something to be executed__
$ENV{'PATH'} = '/bin:/usr/bin:/usr/local/bin';
#__prints header__#
sub header{
print "Content-type: text/html \n\n";
print qq(
Get all keys and values
)
}
#__prints footer__#
sub footer{
print qq(
END OF DOCUMENT
)
}
#__prints warnings__#
sub Warning_One{
print 'KEY OR VALUE IS NOT VALID!';
exit
}
#__helps alot from unwanted SQL queries__
sub antiInjection{
my @badList = qw(select from where union order char drop alter desc show set insert);
chomp(my $param = shift);
$param=~m/$_/i and print "WORD $_ IS BANNED FROM USE!" and exit for (@badList);
}
########## MAIN PROGRAM #########
my $query = new CGI;
my $script_name = "secured.pl";
#__html header__
&header;
#__create test dir__
my $Test_Dir = 'TEST';
unless (-d $Test_Dir){
mkdir ("$Test_Dir", 0755) || die "Error 675 couldn't create
$Test_Dir
$!
";
}
#__get timestamp__
my $Time_Stamp = time;
#__name final file with timestamp value__
my $Results_File = "$Time_Stamp.txt";
my $Results_Path = "$Test_Dir/$Time_Stamp.txt";
#__print date and time to browser__
my $timeToShow = localtime($Time_Stamp);
print"
On $timeToShow we saved results to file: ($Results_File)
";
#__use timestamped file to add some data__
open (RESULTS, ">>$Results_Path") || die "Error 5643: can't print to
$Results_Path
$!
";
flock (RESULTS, 2);
#__obtain all fields__
my @fields = $query->param;
#__list of values for each parameter__
my @vals;
for my $key (@fields){
#__check keys__
chomp($key);
#__warning if forbidden characters to be involved__
&Warning_One if $key=~m/[^\w.-]+/;
#__it's secured and untainted now__
$key = $1 if $key=~m/([\w.-]+)/;
#__to make sure the digit is digit__
$key += 0 unless $key =~ m/\D+/;
&antiInjection($key);
#__obtain all values__
@vals = $query->param($key);
for my $value (@vals){
######## START REGEX ############
chomp($key,$value);
&Warning_One if $value=~m/[^\w.-]+/;
$value=$1 if $value=~m/([\w.-]+)/;
$value+=0 unless $value=~m/\D+/;
&antiInjection($value);
######## END REGEX ##############
######## PRINT TO FILE ##########
print RESULTS "Key ($key) Value ($value)\n";
######## PRINT TO THE BROWSER ##########
print"Key ($key) value ($value)
";
}
}
###################
### CLOSE FILE
###################
flock (RESULTS, 8);
close (RESULTS);
chmod (0666, "$Results_Path") || die "Error 5641: can't chmod to
$Results_File)
$!
";
&footer;