Re^5: Using relative paths with taint mode

Replies are listed 'Best First'.
Re^6: Using relative paths with taint mode by Bod (Parson) on Jun 21, 2021 at 22:45 UTC
Why is that so? Because that's where it gets put on my shared hosting... When I add a domain in cPanel it adds this by default: `/home/myusername/domain/cgi-bin/` [download] Where `domain/` is the webroot. I modify it slightly cPanel so I get: `/home/myusername/domain/prod/cgi-bin/ /home/myusername/domain/test/cgi-bin/ /home/myusername/domain/dev/cgi-bin/` [download] Where: www.domain.com -> `prod/` test.domain.com -> `test/` dev.domain.com -> `dev/` Because that's the way cPanel does it, I hadn't considered that there was a better way!	[reply] [d/l] [select]
Re^7: Using relative paths with taint mode by haj (Vicar) on Jun 22, 2021 at 12:52 UTC
Why is that so? Because that's where it gets put on my shared hosting... Well, yeah, that explains a lot. In that case you might be stuck with `.htaccess` and all its shortcomings. Or maybe not, since your environment setup somewhat resembles virtual hosts, each of which can have its own config. But again, that's a question of "secure virtual host configuration" and not of "taint mode".	[reply]
Re^8: Using relative paths with taint mode by Bod (Parson) on Jun 25, 2021 at 17:26 UTC
Based on all the wisdom, advice and direction monks have kindly supplied in this thread, I've changed the setup of a newly created site... `/home/myusername/website/prod/www <- webroot /home/myusername/website/prod/lib <- scripts /home/myusername/website/prod/template <- you can guess :) /home/myusername/website/test/ ...` [download] With a bit of experimentation I've found that scripts will run in the webroot. So, a config tweak and the default file provided in `www` is no longer `index.html`. Instead it is a Perl script that calls a couple of modules hidden away in `lib` which is where all the work gets done. I have not got very far yet with (re)building this site but already the arrangement feels better. More importantly it feels more secure which is rather important here. Thank you to everyone who contributed here.	[reply] [d/l] [select]
Re^7: Using relative paths with taint mode by afoken (Chancellor) on Jun 24, 2021 at 07:55 UTC
(See also Re^5: Using relative paths with taint mode and Re^7: Using relative paths with taint mode) When I add a domain in cPanel it adds this by default: `/home/myusername/domain/cgi-bin/` [download] Where `domain/` is the webroot. I modify it slightly cPanel so I get: `/home/myusername/domain/prod/cgi-bin/ /home/myusername/domain/test/cgi-bin/ /home/myusername/domain/dev/cgi-bin/` [download] That should be sufficient to get any number of protected directories that are not reachable via HTTP(S), without messing with `.htaccess` files: Given that only very few characters are allowed in host and domain names (only ASCII letters, ASCII digits, and the hypen are allowed for any subdomain, and the dot separates subdomains), it is trivial to create a directory below `/home/myusername/` that is NOT a valid domain name, e.g. `_lib` or `!private`. (Note that all Internationalized domain names use Punycode to encode Unicode to that restricted set of characters.) Even without shell and FTP access, you seem to be able to modify cPanel, and cPanel can create directories. So you can modify cPanel to create the directories. Now you can create directories unreachable for HTTP(S) clients where you can store modules, configuration and database files. Of course, depending on the actual webserver configuration, it may be possible to manually issue an HTTP request with an invalid hostname after using a valid hostname to resolve the IP address of the server. So to be paranoid, put a `.htaccess` file in those protected directories that prohibits all access. It won't affect the normal webserver use at all, it is just a last resort. Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply] [d/l] [select]