Hey Everyone,

So I'm writing a simple CGI in perl and I wanted to use Apache::Session (specifically ::File, though ::DB or ::MySQL isn't out of the question if it comes to that). I have my login/authentication working and am feeding back a session cookie that contains a session ID that I got from Apache::Session. That's all good, I can store and retrieve stuff just fine (I think, so far everything I've tried has worked).

The problem comes when I try to follow my 'logout' link which, among other things, attempts to remove the session by using tied(%session)->delete (which I saw done somewhere here, I think). When I do that I get the following in my error_log file:

Insecure dependency in unlink while running with -T switch at /usr/lib
+/perl5/site_perl/5.6.1/Apache/Session/Store/File.pm line 106., refere
+r: <referring url>
[download]

Now I'm doing my best to make sure I'm not passing tainted values around, but this one has me completely stumped. My existing code is kind of a mess, but I've broken out the specific bits that can reproduce exactly the same symptoms. See below.

I'm not sure what other information to provide that may be helpful, but I'd really appreciate any advice anyone may have. Just to try and head off the first questions, yes the directorys are owned and rwx by the same uid/gid as the script. In fact my script is setuid for reasons that aren't really relevant, I don't think. The test script below will do the same without being setuid provided the directories (foo.com/cgi-bin/.sessionDir and .../.lockDir) are readable/writable/executable to the web server, which happens to be nobody:nogroup in my case.

Oh, and I tried using CGI::Session instead of Apache::Session, but it did awful things like giving me a session id and then creating a session file with a completely different id. I saw on their mailing list that someone else back in December had seen exactly the same thing and there were no replies to his problem, so I'm lead to believe that no solution awaits me down that road. :-)

Thanks. Any suggestions, no matter how off the wall, happily accepted.

-J.

#!/usr/bin/perl -T
use strict;

package sessionTest;

use Apache::Session::File;
use CGI::Safe qw/ taint :standard :html3 :html4 /;
use CGI::Carp qw/ fatalsToBrowser /;

my $query = CGI::Safe->new;
my $sessionCookie;
my %session;
my $id;
my $sessionID;

my $scriptName = $query->self_url;
$scriptName =~ s/\?.*//;

$sessionCookie = $query->cookie(-name=>'sessionTest');
if (defined($sessionCookie))
{   
    if ($query->url_param('keywords') =~ /logout/)
    {   
        # in here $sessionCookie actually contains the value of the co
+okie,
        # below it is the whole cookie.
        #
        # This could be done by reusing the $id value, but I think it'
+s a bit
        # clearer here that we're reading a previous session id if we 
+do it
        # this way.
        $sessionCookie =~ /([a-z0-9]+)/;
        $sessionID = $1;
        tie %session, 'Apache::Session::File', $sessionID,
        {   
            Directory       =>  './.sessionDir',
            LockDirectory   =>  './.lockDir'
        };
        tied(%session)->delete;
        untie(%session);
        $sessionCookie = $query->cookie(
            -name=>'sessionTest',
            -value=>"",
            -expires=>'Thu, 31-Dec-1974 00:00:00 GMT'
        );
        print $query->redirect(-uri=>"$scriptName",-cookie=>$sessionCo
+okie);
    }
    else
    {
        # the browser has a session cookie, print out a page that will
+ let us
        # remove it.
        print $query->header();
        print $query->start_html(-title=>"Welcome back");
        print "Your session id is $sessionCookie.";
        print "<a href=\"$scriptName?logout\">click here</a> to log ou
+t\n";
        print $query->end_html();
    }
}
else
{
    # the browser doesn't have a session cookie, feed it one.
    tie %session, 'Apache::Session::File', $id,
    {
        Directory       =>  './.sessionDir',
        LockDirectory   =>  './.lockDir'
    };
    $sessionCookie = $query->cookie(
        -name       =>  'sessionTest',
        -value      =>  $session{_session_id},
        -expires    =>  0
    );
    untie(%session);
    print $query->redirect(-uri=>"$scriptName",-cookie=>$sessionCookie
+);
}
[download]