Is it possible to use WWW::Mechanize on a file upload field?
It's clearly possible to use WWW::Mechanize for file upload: unless you implement some human detection test (e.g. captcha, which usually web server don't), there's no way for the web server to tell if some input came from a human clicking on a form or from a WWW::Mechanize script. Moreover, it's also possible to use "plain" LWP::UserAgent to do this, even if WWW::Mechanize is way easier IIRC.
Or is there something special about this field?
There is indeed something special, i.e. the Content-Type of the request has to be set to multipart/form-data instead of the default application/x-www-form-urlencoded. But this should happen automatically. See also docs for HTTP::Request::Common for more info.
And if it is possible, would it not also be possible to pass files as a hidden parameter and possibly steal information?
I don't understand this. Unless there's some bug on the server or cgi-script, why should *uploading* a file to the server allow someone to *steal* data from it?
I need to populate a form field for my uploader but if it works, I can't help but think there's a whole security thing with uploaders I wasn't aware of.
Uploaders can make a process automatic, so there's pretty the same level of risk that you have with anything you make automatic: it can go damned fast and saturate your resources (bandwidth, disk, whatever). I don't see other particular security issues.

Note that I'm not telling that there aren't security issues, only that I don't see particular differences with respect to other forms of automatisation; probably only the possible target resources are different (in this case, for example, disk space would be threatened, while in others could be not).

Could you be more specific?

Flavio
perl -ple'$_=reverse' <<<ti.xittelop@oivalf

Don't fool yourself.

In reply to Re: CGI file uploads by polettix
in thread CGI file uploads by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.