Interpolation problem?

parallelgoon has asked for the wisdom of the Perl Monks concerning the following question:

Why won't this work? Is it an interpolation issue or what? The output file is never written to...

#!/usr/local/bin/perl -wT
use strict;
use CGI 'param';

my $outfile = param('outfile');

open(OUT,">>$outfile") || die;
print OUT "blah blah blah";
close(OUT);
[download]

Comment on Interpolation problem? Download Code

Replies are listed 'Best First'.
Re: Interpolation problem? by ViceRaid (Chaplain) on Mar 23, 2004 at 10:46 UTC
Hi. You're running with taint mode on (-T), and you're not untainting the CGI parameter `$outfile` before you use it to open a file on the system for writing. The idea of taint is to stop you doing dangerous things (like opening filenames) with untrusted data (like CGI parameters). Try using a regular expression on the CGI parameter variable to check it contains what you're expecting. cheers ViceRaid	[reply]
Re: Interpolation problem? by tinita (Parson) on Mar 23, 2004 at 14:02 UTC
$outfile is tainted. for more information on untainting see perlsec. also it's very useful to include the error $! into the die()-message, so that you can see why the open failed.	[reply]