Re: Array values reformation

Now your user sees pretty labels, while your param("choice") will still return full pathnames.

Yes, that makes it easier to go to things like "http://server/script.cgi?choice=%2Fetc%2Fpasswd" too ;)

--
b10m

All code is usually tested, but rarely trusted.

Comment on Re: Array values reformation Download Code

Replies are listed 'Best First'.
Re^2: Array values reformation by LassiLantar (Monk) on Jul 24, 2004 at 21:09 UTC
Hehe, good point b10m. So is the only way to pass things like this securely by storing them in local files inaccessible to the user since you can't pass anything between instances of the script (non-persistant environment) and you shouldn't pass anything as a value (not secure)? Peace, LassiLantar	[reply]
Re: Array values reformation by b10m (Vicar) on Jul 24, 2004 at 21:15 UTC
Well, you'll have to keep in mind that "(L)users are evil"™ Your first answer was already better, but I'm not exactly sure how Perl would handle input like "`../../../../etc/passwd\0`" (read: too lazy to test it). A little more secure would be to store the allowed files in a hash or array and give those choices to the l-user. -- b10m All code is usually tested, but rarely trusted.	[reply] [d/l]
A reply falls below the community's threshold of quality. You may see it by logging in.
A reply falls below the community's threshold of quality. You may see it by logging in.