in reply to Safely passing CGI form data to a shell command

First off, qx is not going to be easily secure. Use system LIST, or, in your case, IPC::Open2 with a list. (You can close the writer handle immediately since you don't need it.) This helps get rid of the shell, which is a huge annoyance except when it's a huge help. This isn't one of those help times.

Second, as has been mentioned, you want to detaint whatever is passed in. You want to use /([[:alpha:]-]+)/ or something like that. [:alpha:] is a character class (thus must also be inside []'s) which honours locale information. Which may mean setting your locale (say to a UTF8 locale) and decoding the input to UTF8 as well (before detainting, of course) - I'm not too sure here because I've not had a reason to cross codepages before (that is, what is passed in may be a different codepage than what I'm running in).

Replies are listed 'Best First'.
Re^2: Safely passing CGI form data to a shell command
by Tommy (Chaplain) on Apr 21, 2005 at 19:10 UTC

    May I say, sweeeeeeeeeeet! Thanks All! I am confident the solutions suggested will, in summation, provide what I have sought. I have resolved upon using system() and -T + regexp.

    Again I thank you!

    --
Tommy Butler, a.k.a. Tommy
[reply]
      be carefull also with '-' and '+' chars. If you allow them, user could turn arguments in command options, i.e. '-foo'.

      Most Unix programs allow the double dash ('--') to be used to stop option parsing, so instead of ... 

      system 'foo', $arg;

      [download]
      ... it's better to use ... 
      system 'foo', '--', $arg;

      [download]
[reply]
[d/l]
[select]

      :(

      I can't get around this error and stfw and rtfm is yielding no help.

      Can someone help me decipher the error message I'm getting? It's apparently fatal.

      Oh, and by the way. I've realized now that system() and exec() are useless to me as neither returns the output of my command. Duhhhhhh.

      from http://perldoc.perl.org/functions/system.html
      The return value is the exit status of the program as returned by the wait call. To get the actual exit value shift right by eight (see below). See also "exec". This is not what you want to use to capture the output from a command, for that you should use merely backticks or qx// , as described in "`STRING`" at perlop. Return value of -1 indicates a failure to start the program (inspect $! for the reason).

      Code:

      my(@call) = system($call);

      Error:

      Insecure dependency in system while running with -T switch

      --
Tommy Butler, a.k.a. Tommy
[reply]
[d/l]

        I said in my previous post that "in your case" you should be using IPC::Open2. That is used to capture output from a program (as well as send input, but you can close the writer since you're not sending input) while still allowing a LIST like system and exec to bypass the shell.

        The taint problem is likely that you didn't resent your environment. Check out perlsec on how to set your environment securely.

[reply]

In Section Seekers of Perl Wisdom