Your script contains a security hole. The value of ( param() )[0] is given directly to your two-arg-open() call. It looks like your -e test might be enough to prevent people from taking over your shell but it is at least giving the world access to read any file on your hard drive.

Please read perlsec, turn on tainting, and learn to use three-arg-open: open ..., "<", $full or die "Couldn't open $full for reading: $!"

I can see your concern but do not really see how anyone can read any file on my filesystem by this usage. Permissions will not allow for any privilaged file to be read by a webserver running as "nobody" or any other non-privilaged user.

Not to mention the hard coded variable of $path which is not changeable by the user and is the entire first portion of the variable $full's value.

If there is a way to break out of this directory with the current state of this script please be specific because I do not see it.

I have read about the two and three arg open calls but do not see in this implementation how a three arg open call will help any. Now I am not saying it won't because I am the farthest thing from an expert but if it will please again be more specific.

Edit: Ohh wait a minute! Oh crap I see it and tested it and yes you are correct. Big oversight on my part. Thanks for the heads up! Permissions do save me on privilaged files but there are some un-privilaged files Apache can read that people have no buisness looking at and can lead to further exploitation.


www.perlskripts.com

See about using File::Spec and functions like splitpath() or no_upwards(). Also, use the three-arg open because even if a user gives you a filename like " foo |" or ">bar" then you are specifying the "action" part of the open separately. It tells perl that everything in the filename portion of the function is a filename and no part of that is to be interpreted specially.

I locked down this script using some of the methods you suggested mbut was not able to use taint mode. I got the famous error saying it was too late for taint mode. I tried -wT, -Tw, -w -T, -T -w. The only way I could get taint mode to be used was envoke it via command line but this is not an option running the script over the web.

I changed the two-arg-open call to a three-arg-open after your explanation. I had never considered the laziness of the two-arg implication function.


www.perlskripts.com

#!/usr/bin/perl -wT

Um... that should be enough. Are you using mod_perl instead of cgi? That would do that - you'd load -T during the startup.pl in your apache configration then.

Is there anyway I can use this method and not have the web browser parse the cgi source code as html code and simply display as text?

Ahh yes this works great for spacing and indention but html is still rendered inside the pre tag.

www.perlskripts.com

Try this

for (@source) {
  s/&/&/g;
  s/</&lt;/g;
  print;
}
[download]

or use the HTML escape routine in CGI.
"What should it profit a man, if he should win a flame war, yet lose his cool?"

You're already using CGI so why not just import escapeHTML and use it on the contents of the script?

antirice    
The first rule of Perl club is - use Perl
The ith rule of Perl club is - follow rule i - 1 for i > 1

my $cgi   = new CGI;
my @param = $cgi->param();
...
my $full = $path.$param[0];
...
open(FILE, "$full") || error();
[download]

Thank you once again for showing just how wrong you can create a script. Nice. I'll take everything you've written as the "before" column in my next training course. Loads of laughs.