(Ovid) RE(2): getting a cgi script working

ivory: my sincerest apologies for contradicting you, but I would recommend someone NOT use this online course.

Does not explain taint checking until chapter 16 (and then has subtle errors in her regex and her "manpage" lister won't list all manpages). Taint checking also appears to be the extent of her security knowledge.
Her "taint checking" example also has a glaring security hole. If the form value doesn't pass her taint checking, she prints it back out to the browser. That would allow a hacker could allow a hacker to exploit cross-site scripting vulnerabilites with JavaScript and to do redirects to other sites.
She doesn't use the -w switch, strict, or CGI.pm. Leaving any of those three off is going to cause the Web developer to waste a lot of time debugging things that they'd catch instantly with those three.

Cheers,
Ovid

Comment on (Ovid) RE(2): getting a cgi script working

Replies are listed 'Best First'.
RE: (Ovid) RE(2): getting a cgi script working by ivory (Pilgrim) on Jul 31, 2000 at 13:37 UTC
Hmmm...no problem. I must admit that I neither read the course nor the original post as thuroughly as I should have. Figured a free course might help... :) Thanks for pointing out some problems with the course...but the basics are there, right? --Ivory	[reply]
RE: RE: (Ovid) RE(2): getting a cgi script working by davorg (Chancellor) on Jul 31, 2000 at 13:40 UTC
Well, I haven't seen the course itself, but the flaws that Ovid lists are pretty fundamental. -- <http://www.dave.org.uk> European Perl Conference - Sept 22/24 2000, ICA, London <http://www.yapc.org/Europe/>	[reply]
RE: (Ovid) RE(2): getting a cgi script working by davorg (Chancellor) on Jul 31, 2000 at 14:05 UTC
I've just taken a closer look at this course and would like to add another problem to Ovid's list. The CGI parameter parsing routine contains the same bug that I have been banging on about on numerous nodes here. In short, it breaks when given a CGI query string that looks like: `key1=val1&key2=val2a&key2=val2b` [download] According to the CGI specs, this is completely valid and both values for the key 'key2' need to be accounted for. The code given in the CGI101 course overwrites the first value with the second. Looks like this course should be avoided. -- <http://www.dave.org.uk> European Perl Conference - Sept 22/24 2000, ICA, London <http://www.yapc.org/Europe/>	[reply] [d/l]