Inspired by Protect Downloads.

There are a number of problems with the way ActivePerl sets up Script Mappings for IIS...

  1. You need execute permission (i.e. you can run a .exe by entering it in the URL)
  2. You can't access $ENV{path_info} (i.e. /script.pl/path_info won't work
  3. only .pl and .plx are set up
This script fixes all the above.

Update: Fixed bug caused by differences between NT & 2000. Script now detects if NT or 2000 (sort of)

Update 2: Added .pm mapping, to stop people being able to view source of perl modules that might be in a webroot.
# MDSN: http://msdn.microsoft.com/library/en-us/iisref/html/psdk/asp/a
+pro9tkj.asp
use strict;
use warnings;
use Win32::OLE qw(in);

# Connect to IIS on the Local Machine with ADSI...
my $iis_web_object  = Win32::OLE->GetObject("IIS://LocalHost/W3SVC")
            or die "Can't access IIS on the local machine\n";

my ($perl_path) = $^X =~ /(.*)\\[^\\]+$/;
my $iis_verbs = ((Win32::GetOSVersion)[1] == 5) ? 'GET,HEAD,POST' : 'P
+UT,DELETE';

foreach my $path (in $iis_web_object->GetDataPaths("ScriptMaps", 0)) 
{
    my $node = Win32::OLE->GetObject($path);
    print "Setting $path...\n";
    
    my $str_maps = $node->{ScriptMaps};
    my %script_maps;
    foreach (in @$str_maps) { 
        my ($ext, $exe, $script, $verbs) = split /,/, $_, 4;
        $script_maps{$ext} = { exe => $exe, script => $script, verbs=>
+ $verbs}
    }

    $script_maps{'.pl'} = $script_maps{'.pm'} = $script_maps{'.cgi'}  
+= 
        { exe => $^X.' "%s" %s', script=> 1, verbs=> $iis_verbs };

    $script_maps{'.plx'} = 
       { exe => $perl_path."\\perlIS.dll", script=> 1, verbs=> $iis_ve
+rbs };

    my $new_maps = [];
    foreach (sort keys %script_maps) { 
        push @$new_maps, join ',',
            $_ , $script_maps{$_}->{exe} , $script_maps{$_}->{script} 
+, 
            $script_maps{$_}->{verbs}
    }

    $node->{ScriptMaps} = $new_maps;
    $node->SetInfo();
}
undef $iis_web_object;

[download]

Replies are listed 'Best First'.
Re: Fix ActiveState Script Maps (IIS)
by $code or die (Deacon) on Aug 08, 2001 at 01:13 UTC
    While you're editing script maps, you could also fix a few of the security issues in IIS. For example Code Red worm and $DATA vulnerabilites. Add the following code after the $script_maps{'.plx'} line... 
    #
#   Protects against $DATA stream hack which gives
#   everyone access to your source code
#
$script_maps{'.pl:$DATA'} = $script_maps{'.pl'};
$script_maps{'.cgi:$DATA'} = $script_maps{'.cgi'};
$script_maps{'.plx:$DATA'} = $script_maps{'.plx'};

#
#   Protects against Code Red Worm by removing
#   the Index Server script mappings
#
delete $script_maps{'.ida'};
delete $script_maps{'.idq'};

    [download]
    Error: Keyboard not attached. Press F1 to continue.
[reply]
[d/l]
Re: Fix ActiveState Script Maps (IIS)
by Anonymous Monk on Jul 23, 2003 at 06:37 UTC
    When I try to run this script I get the error message at line #7; Can't access IIS on the local machine. What is wrong?
[reply]
      Do a view source on the page and look at the html. Some nice person has inserted 
      <font color="red"><b><u>&shy;</u></b></font>

      [download]
      in the HTML. D'oh!
[reply]
[d/l]
        # MDSN: http://msdn.microsoft.com/library/en-us/iisref/html/psdk/asp/a
+pro9tkj.asp
use strict;
use warnings;
use Win32::OLE qw(in);

# Connect to IIS on the Local Machine with ADSI...
my $iis_web_object = Win32::OLE->GetObject("IIS://LocalHost/W3SVC")
      or die "Can't access IIS on the local machine\n";

my ($perl_path) = $^X =~ /(.*)\\[^\\]+$/;
my $iis_verbs = ((Win32::GetOSVersion)[1] == 5) ? 'GET,HEAD,POST' : 'P
+UT,DELETE';

foreach my $path (in $iis_web_object->GetDataPaths("ScriptMaps", 0))
{
  my $node = Win32::OLE->GetObject($path);
  print "Setting $path...\n";
 
  my $str_maps = $node->{ScriptMaps};
  my %script_maps;
  foreach (in @$str_maps) {
    my ($ext, $exe, $script, $verbs) = split /,/, $_, 4;
    $script_maps{$ext} = { exe => $exe, script => $script, verbs=> $ve
+rbs}
  }

  $script_maps{'.pl'} = $script_maps{'.pm'} = $script_maps{'.cgi'} =
    { exe => $^X.' "%s" %s', script=> 1, verbs=> $iis_verbs };

  $script_maps{'.plx'} =
   { exe => $perl_path."\\perlIS.dll", script=> 1, verbs=> $iis_verbs 
+};

  my $new_maps = [];
  foreach (sort keys %script_maps) {
    push @$new_maps, join ',',
      $_ , $script_maps{$_}->{exe} , $script_maps{$_}->{script} ,
      $script_maps{$_}->{verbs}
  }

  $node->{ScriptMaps} = $new_maps;
  $node->SetInfo();
}
undef $iis_web_object;

        [download]
[reply]
[d/l]

Back to Cool Uses for Perl