Re^6: prevent perl script running from browser

Replies are listed 'Best First'.
Re^7: prevent perl script running from browser by snowchild (Novice) on Oct 01, 2017 at 15:17 UTC
How about this scenario. The script takes plain text from forms input as a parameter and encrypts it using GnuPg then emails the result to us. So yes it would be nice if it were not public accessible from a browser.	[reply]
Re^8: prevent perl script running from browser by afoken (Chancellor) on Oct 01, 2017 at 18:35 UTC
The script takes plain text from forms input as a parameter and encrypts it using GnuPg then emails the result to us. So yes it would be nice if it were not public accessible from a browser. Why? Why don't you do exactly that in the program that accepts the form input? Yo do not need a subprocess for encryption, and you don't need one to send out emails. If the program that accepts the form input is implemented as bad as the code in your first posting in this thread, I would not be surprised at all to find a remote execution exploit based on something that might look like this: `# Don't EVER write code like this! # Don't copy this crap! # This is intentionally insecure code! use CGI (); my $q=CGI->new(); my $forminput=$q->param('some_field'); system("/www/user08154711/cgi-bin/crypt-and-mail-me.cgi '$forminput' & +");` [download] Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply] [d/l]
Re^8: prevent perl script running from browser by marto (Cardinal) on Oct 01, 2017 at 16:24 UTC
This, along with the other issues already pointed out with the code posted, makes me think that there's room for improvement here. Would you want to have one email per completed form?	[reply]