Mighty Monks,

I have been looking at a CMS that builds a filepath to a template based on a base directory path (from config), a relative page path (a query parameter), an optional directory path (a query parameter). and finally a template extension (from config).

The resulting file path is executed with "do EXPR".

As neither of the query parameters were untainted, I had trouble running the calling cgi script in taint mode. So I added the untainting regexes which you can see in the code block below. And the code now successfully runs in taint mode.

My questions:

I appreciate all advice/criticism on coding style etc.

sub load {
    my $self = shift;
    
    my $conf = $self->conf;
    my $query = $self->query;
    
    my @tainted_dirs = File::Spec->splitdir( $query->{dir} );
    my ($tainted_page_volume,$tainted_page_path,$tainted_page_file) = 
+File::Spec->splitpath( $query->{page} );
    my @tainted_page_dirs = File::Spec->splitdir( $tainted_page_path )
+;

    no locale;
    # untaint dir
    my @untainted_dirs;
    foreach (@tainted_dirs) {
        if (m/^([\w.-]+)$/) {
            push (@untainted_dirs, "$1") ;
        } elsif ($_) {
            croak ("TAINTED DIR PARAM: $_: $!");
        }
    }

    my @untainted_page_dirs;
    foreach (@tainted_page_dirs) {
        if (m/^([\w.-]+)$/) {
            push (@untainted_page_dirs, "$1") ;
        } elsif ($_) {
            croak ("TAINTED PAGE DIR PARAM: $_: $!");
        }
    }

    my $untainted_page_file;
    if ($tainted_page_file and $tainted_page_file=~ m/^([\w.-]+)$/) {
        $untainted_page_file = $1;
    } else {
        croak ("TAINTED PAGE FILE PARAM: $tainted_page_file: $!");
    }
    
    my $template_file = File::Spec->catfile(
        $conf->{templates},
        @untainted_dirs,
        @untainted_page_dirs,
        $untainted_page_file . $conf->{template_extension},
    );
    
    my $template = do $template_file
        or croak "Failed to load template file [$template_file] ($!) (
+$@)";

    return $self->template( $template );
}

[download]

In reply to security and un-tainting paths by wrinkles

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.