Need help with security

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Wise Monks,

Below is a script i have wrote which i realy need someone to check over to make sure it is secure.

#!/usr/bin/perl

&GetFormInput ;

$username = $field{'username'} ;     
$domain = $field{'domain'} ;     
$email = $field{'email'} ;     
$service = $field{'service'} ;     
$Signup = $field{'Signup'} ;     
$Cancel = $field{'Cancel'} ;     
$ip = $ENV{'REMOTE_ADDR'} ;

$message = "" ;
$found_err = "" ;

$errmsg = "<p>Please Enter A Valid Username. [Between 3-30 Characters.
+ No Symbols Allowed.]</p>\n" ;

if ($username eq "") {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($username) < 3) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($username) > 30) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

$errmsg = "<p>Error With Domain. Contact Support.</p>\n" ;

if ($domain eq "") {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($domain) < 1) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($domain) > 100) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }


$errmsg = "<p>Please Enter A Valid E-Mail Address. [Between 5-50 Chara
+cters.]</p>\n" ;

if ($email !~ /.+\@.+\..+/) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($email) < 5) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($email) > 50) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }


$errmsg = "<p>Error With Service. Contact Support.</p>\n" ;

if ($service eq "") {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($service) < 1) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

elsif (length($service) > 100) {
    $message = $message.$errmsg ;
    $found_err = 1 ; }

if ($found_err) {
    &PrintError; }

open (LOGFILE, ">> account.log") ;

print LOGFILE "/etc/AddVirtUser.pl --username=$username --domain=$doma
+in --email=$email --ip=$ip --service=$service\n" ;

close (LOGFILE) ;

print "Content-type: text/html\n\n";
print "<html>\n" ;
print "<head>\n" ;
print "blah blah blah\n" ;
print "</body>\n" ;
print "</html>\n" ;
sub PrintError { 
print "Content-type: text/html\n\n";
print $message ;

exit 0 ;
return 1 ; 
}

sub GetFormInput {

    (*fval) = @_ if @_ ;

    local ($buf);
    if ($ENV{'REQUEST_METHOD'} eq 'POST') {
        read(STDIN,$buf,$ENV{'CONTENT_LENGTH'});
    }
    else {
        $buf=$ENV{'QUERY_STRING'};
    }
    if ($buf eq "") {
            return 0 ;
        }
    else {
         @fval=split(/&/,$buf);
        foreach $i (0 .. $#fval){
            ($name,$val)=split (/=/,$fval[$i],2);
            $val=~tr/+/ /;
            $val=~ s/%(..)/pack("c",hex($1))/ge;
            $name=~tr/+/ /;
            $name=~ s/%(..)/pack("c",hex($1))/ge;

            if (!defined($field{$name})) {
                $field{$name}=$val;
            }
            else {
                $field{$name} .= ",$val";
                
                #if you want multi-selects to goto into an array chang
+e to:
                #$field{$name} .= "\0$val";
            }


           }
        }
return 1;
}
[download]

I also need to have the variables $username, $domain, $email, $ip and $service to be checked for nasty characters.

$Username can only accept A-Z, a-z, 1-9 and the following characters .-_
$Domain can only be in the form of domain.com
I believe i have $email sorted already.
$Service can only equal Yes or No

If one of you geniuses could modify my code to perform the above, it would be most appreciated

Comment on Need help with security Download Code

Replies are listed 'Best First'.
Re: Need help with security by dws (Chancellor) on Aug 23, 2002 at 20:12 UTC
Below is a script i have wrote which i realy need someone to check over to make sure it is secure. The quick answer, based seeing none of -T # taint mode use strict; use CGI; is "probably not." And on closer examination, your URL decoding logic is buggy. Don't roll your own logic. Let CGI.pm do it for you. And on closer examination, there's nothing to prevent someone from forging a form that contain a username of `;/bin/rm -f \n` If one of you geniuses could modify my code to perform the above, it would be most appreciated* You'll learn more, and will be better off in the long run, if you put some more work in on this yourself. We'll be happy to re-review your work, and offer pointers. One such pointer is that you might find it worthwhile to read Ovid's Web Programming User Perl course. You'll find most, if not all, of what you need there.	[reply] [d/l]
Re: Need help with security by fglock (Vicar) on Aug 23, 2002 at 20:03 UTC
You should read more about "taint" and "use strict;" and "use CGI;". They will really help you a lot. These thingies will check things for you so you don't go home after work thinking "is my script secure?".	[reply]
Re: Need help with security by Ovid (Cardinal) on Aug 23, 2002 at 20:13 UTC
At the risk of tooting my own horn, you really should read my CGI course. You have many issues with your code that I directly address. Cheers, Ovid Update: Looks like dws beat me to it. Thanks :) Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.	[reply]