in reply to Securing your SOAP Application

* Anecdote Alert *

I was at a conference about Web Services earlier this year. In one of the presentations, someone explained how you can put a scripting language source code in XML into a SOAP envelope, send it to a server, use XSLT on the serverside to re-create the scripting language source code out of that in a file and then run the script in the file to get the result. Seriously.

Liz

Replies are listed 'Best First'.
Re: Re: Securing your SOAP Application
by hardburn (Abbot) on Jul 30, 2003 at 20:08 UTC

    You mean like this?

    #!/usr/bin/perl
use SOAP::Transport::HTTP::CGI;
SOAP::Transport::HTTP::CGI
  -> dispatch_to('ReallyInsecureDontDoThis')
  -> handle;

package ReallyInsecureDontDoThis;

sub run_code { eval shift }

    [download]

    Client side:

    #!/usr/bin/perl
use SOAP::Lite;
my $soap = SOAP::Lite 
    ->uri('ReallyInsecureDontDoThis') 
    ->proxy('http://www.example.com/insecure_server.cgi');
$soap->call(run_code => q/system('rm -rf /')/);

    [download]

    ----
    I wanted to explore how Perl's closures can be manipulated, and ended up creating an object system by accident.
    -- Schemer

    Note: All code is untested, unless otherwise stated

[reply]
[d/l]
[select]
      Basically, yes.

      With the added complication of using XSLT to process the entire SOAP XML, creating a script on disk to be run.

      Liz

[reply]

In Section Meditations