I think the results you get from File::Find are tainted. This is good as you don't want to have unexpected filenames and don't want to change them to (even) 664. Also, operating on $_ works, but I prefer operating on $File::Find::name, as having absolute filenames is much better in error messages. I would look at perlsec and do something like the following:

sub setperms {
    my $fn = $File::Find::name;
    my $untained_fn;
    my $mode;
    if ($fn =~ m!^(\Q$baseDir\E([/\w.]+)\z!) {
        $untainted_fn = $1;
        $mode = 0664;
    } else {
        $fn =~ m!^(.*)$!;
        $untainted_fn = $1;
        $mode = 0000;
        warn "File name '$untainted_fn' does not match criteria, setti
+ng mode to 0.";
    };

    chmod($untained_fn,$mode) or die "Couldn't change '$untainted_fn' 
+to $mode: $!";
};

[download]

Also, you should really, really consider whether you want to have any script that runs as root accessible from the outside of your computer. I recommend having that script run from a cron job and having as the CGI program a program that just appends filenames to a list.

In reply to Re: Insecure dependency in chmod while running setuid by Corion
in thread Insecure dependency in chmod while running setuid by ak4good

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.