in reply to RE: Warning our Fellow Monks
in thread Warning our Fellow Monks

Taint checking would have fatally crapped out when it discovered that you were attempting to use a piece of a foreign string in a critical operation (opening a file). So yes, it would have been quite sufficient in detecting the problem, but it does nothing to help you fix your script so that it will actually run.

Your best bet is to use tokens in your URL submissions, and then map those tokens to a set of filenames. If that can't be arranged, use a regular expression to "untaint" the data by explicitely declaring permitted characters. 

($secure) = ($tainted =~ /(\w+)/);
open(F, "< $secure") or die "$!";   # read only

"../../bin/ls -l /etc|" -> "bin"  (no such file)

[download]

Replies are listed 'Best First'.
(Ovid - Duking it out over security) RE(3): Warning our Fellow Monks
by Ovid (Cardinal) on Oct 12, 2000 at 00:28 UTC
    Fastolfe: you need to check for failure on your regex. Currently, if it fails and if there was a value already in $1, it will be passed to $secure. That could be disastrous. If a cracker gets your code and figures out how to pass "../../../bin/some_executable" into the previous backreference, you're back to the original problem.

    Also, if the filename has a period delimited extension (and many of them do), your regex won't work (e.g. "somefile.txt").

    Cheers,
    Ovid

    Update: I'm a moron. Fastolfe is right. Read dchetlin's response below. (sniff, sniff)

    That's what I get for reading his code too fast :(

    Join the Perlmonks Setiathome Group or just go the the link and check out our stats.

[reply]

      Here's the REx Fastolfe posted:

      ($secure) = ($tainted =~ /(\w+)/);

      I certainly agree that the success needs to be checked, as there's an open being called with $secure on the next line, but $secure will not be ending up with a previous value of $1; if the REx fails, it will simply be undefined.

      -dlc

[reply]
[d/l]
[select]

In Section Perl Monks Discussion