Re: cgi redirect

So what happens when one of the form values is "; rm -rf /" or "; cat /etc/passwd"?

Much safer to use remove_tree from File::Path instead. And check your input values, because they can still refer to parent directories! (File::Spec can help you manipulate the filenames.)

Comment on Re: cgi redirect Select or Download Code

Replies are listed 'Best First'.
Re^2: cgi redirect by mitchreward (Acolyte) on Sep 30, 2014 at 09:05 UTC
I'm the only one to use this web page, that is not accessible from the internet. But yeah you're right otherwise, I'd have protected it.	[reply]
Re^3: cgi redirect by Anonymous Monk on Oct 01, 2014 at 01:34 UTC
This is how security holes get born... maybe someday you'll open the script up for others to use, or you'll be working on something for a client and remember that time you wrote this script, and just copy it over since that's the easiest solution, or ... Better to protect it from the start. And it's not hard to do, at least throwing this in as the first line of the `foreach` already helps against some of the bad stuff: `tr{a-zA-Z0-9_/-}{}cd` (still doesn't protect against symlinks into other directories, and if you add the dot to that list, it won't protect against "..", etc.)	[reply] [d/l] [select]
Re^3: cgi redirect by Anonymous Monk on Oct 01, 2014 at 21:08 UTC
Capture::Tiny `use Capture::Tiny qw/ capture /; my($stdout, $stderr, $exit) = capture { system( 'rm', '-rf', @paths ); };` [download]	[reply] [d/l]