Zaxo's advice is solid, but the perlsec man page is deeply detailed and includes discussion of other issues that are not relevant to CGI and web scripting in general (e.g., you might get lost in the discussion of "setuid" and "setgid" scripts, which don't apply to what you want to do).

In terms of giving you "the skinny" on "the big picture" (block that metaphore!), the basic primary piece of wisdom is: do not trust anything you get from the client who is sending you any sort of request.

If you put up a page containing a form, and write a cgi script to process the parameters that can be posted by a client via that form, don't just assume that every request to your cgi script actually comes from that page, because someone can view your page source, and mechanize any sort of bot to pound your cgi script with all sorts of probing parameter values, especially if there's any conceivable incentive to do so.

That's what "taint checking" is all about. Values coming from the client need to be checked to assure that they meet specific expectations. An adequate check might just be a matter of limiting the length of a string (for storage to a file or database field), or making sure a string consists of just digits, or matches one of a set of specific hash keys that are either hard-coded in your app or read in from a "trusted" source.

Since it's usually hard to anticipate all the ways that a given process or input can go wrong, the general rule of thumb is for the taint-check logic to look specifically at the conditions that are necessary in order for something to be "right". If a given parameter value is expected to be extremely varied or complicated, make sure you don't try to do anything "risky" with that value -- don't use it as part of a shell command or sql statement. (Save it to a file, or use a placeholder in the sql statement and pass the value as a paramter when executing the sql.)

I don't think it will help much to say any more, until you show us some code that you're thinking of using.

In reply to Re: Curiosity and Security by graff
in thread Curiosity and Security by brayshakes

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.