RE: do not use this script in a public environment!

Replies are listed 'Best First'.
RE: RE: do not use this script in a public environment! by perlcgi (Hermit) on Jun 02, 2000 at 18:07 UTC
A great source for CGI security info is CGI Programming with Perl. Chapter 8 on Security is free! on line at at O'Reilly.	[reply]
RE: do not use this script in a public environment! by antihec (Sexton) on Jun 02, 2000 at 18:10 UTC
> If you have any suggestions as for where > to find tutorials etc. on writing safe CGI- > scripts, please go ahead Well, actually I don't know any resources. Perhaps we should go start creating one around the Monastery here? Would Q&A be an ok Area for such a thing, or should we perhaps make it into a tutorial. I can't say I know enough about security to cover Everything(tm) - but with the help of fellow monks it could get a nice (and IMHO needed) thing. What are your thoughts on this? super: now I'm done writing this, I note a certain "perlcgi" obsoletes my node before even having finished it. Thanks a lot! ;-) `-- bash$ :(){ :\|:&};:` [download]	[reply] [d/l]
RE: RE: do not use this script in a public environment! by mikkoh (Beadle) on Jun 03, 2000 at 01:54 UTC
Well, the Perl security manpage at the Library is a very good read, though it doesn't really cover CGI. A must_read anyway. //mjh	[reply]
RE: RE: do not use this script in a public environment! by antihec (Sexton) on Jun 03, 2000 at 01:30 UTC
In a current posting from SANS (System Administration, Networking, and Security) they state "Vulnerable CGI programs and application extensions (...)" as the second most critical internet security risk. One of the remedies they offer is - surprise - "Write safer CGI programs", and they recommend the following links: http://www-4.ibm.com/software/developer/library/secure-cgi/ http://www.cert.org/tech_tips/cgi_metacharacters.html http://www.cert.org/advisories/CA-97.24.Count_cgi.html As of now, I didn't check those myself, but maybe someone finds them useful?! `-- bash$ :(){ :\|:&};:` [download]	[reply] [d/l]