Re^5: prevent perl script running from browser

You alter/assign referrer, either in perl scripting or browser plugin.

Yes, but that does not matter. The idea is that $ENV{'HTTP_REFERER'} is set to some nonsense only if running as CGI. Unfortunately, this is not entirely true. Clients can choose not to send a Referer header, so you might run a CGI with $ENV{'HTTP_REFERER'} not set. Using $ENV{'GATEWAY_INTERFACE'} should be reliable. It is set by the webserver, it is always set, and it is set to a constant value independent from the HTTP request.

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

Comment on Re^5: prevent perl script running from browser Select or Download Code

Replies are listed 'Best First'.
Re^6: prevent perl script running from browser by marto (Cardinal) on Oct 01, 2017 at 10:39 UTC
All of this seems moot to me. I can't think of a scenario where having something only to be run locally is hosted in this way.	[reply]
Re^7: prevent perl script running from browser by snowchild (Novice) on Oct 01, 2017 at 15:17 UTC
How about this scenario. The script takes plain text from forms input as a parameter and encrypts it using GnuPg then emails the result to us. So yes it would be nice if it were not public accessible from a browser.	[reply]
Re^8: prevent perl script running from browser by afoken (Chancellor) on Oct 01, 2017 at 18:35 UTC
The script takes plain text from forms input as a parameter and encrypts it using GnuPg then emails the result to us. So yes it would be nice if it were not public accessible from a browser. Why? Why don't you do exactly that in the program that accepts the form input? Yo do not need a subprocess for encryption, and you don't need one to send out emails. If the program that accepts the form input is implemented as bad as the code in your first posting in this thread, I would not be surprised at all to find a remote execution exploit based on something that might look like this: `# Don't EVER write code like this! # Don't copy this crap! # This is intentionally insecure code! use CGI (); my $q=CGI->new(); my $forminput=$q->param('some_field'); system("/www/user08154711/cgi-bin/crypt-and-mail-me.cgi '$forminput' & +");` [download] Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply] [d/l]
Re^8: prevent perl script running from browser by marto (Cardinal) on Oct 01, 2017 at 16:24 UTC
This, along with the other issues already pointed out with the code posted, makes me think that there's room for improvement here. Would you want to have one email per completed form?	[reply]