A few minor points on file uploads.

First of all the CGI.pm docs are particularly bad on this point. They do not even die on failed opens. In addition when done right you should be sure to address issues such as race conditions and not trusting user input for filenames.

And speaking of not trusting user input, the following Phrack article should give some food for thought on how easy it is to go very, very wrong. And note that simple taint checking may or may not help, often people just pass virtually anything through rather than thinking about why the check is there and what can happen.

Among other things it will show you why security concious programmers are likely to explicitly: 

open (FOO, "<$foo") or die "Cannot read $foo: $!";

[download]
rather than just trusting the filename...

In reply to Re (tilly) 1: Security question by tilly
in thread Security question by Ovid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.