I'm working on a CGI script that accepts an upload and emails it to a preset address. It uses CGI and MIME::Lite for the appropriate bits and is based, in part, on merlyn's column on the subject.

While experimenting with this and reading the relevant documentation, I learned that it was possible control the Encoding of the attachment in the resulting email. For example:

my $cgi = new CGI;
my $file = $cgi->upload( 'uploadfile' );
my $info = $cgi->uploadInfo( $file );

# error checking deleted for brevity.

# Cut the user's path from the file name.  We don't care where 
# they stored it and it prevents most funky browser behavior.

fileparse_set_fstype( "MSWin32" ); # normally risky; "okay" here [1]
my ( $name ) = fileparse( $file );

# more stuff deleted, including validations and user feedback.

my $msg = MIME::Lite->new(
      Type       => 'multipart/mixed',
      From       => $cfg{ "MSGFROM" },   # [2]
      To         => $cfg( "MSGTO" },
      Subject    => $cfg( "MSGSUBJECT" }
   );

$msg->attach(
      Disposition = 'attachment',
      Type        = $info->{ "Content-Type" },
      Encoding    = 'base64';
      Filename    = $name;
      FH          = $file;
   );

# The rest deleted
[download]

My petition is this: Am I making a dangerous assumption about Encoding? As I read the documentation, it should help make the submission slightly more secure as the email travels the wires. However I want to make sure I'm not deluding myself with a bad meme, cargo-cult-programming, or other form of "the usual mistakes."

Please note that I'm not trying to get overly zealous about it. If I was really paranoid, we'd be using PGP keys, etc. I'm just trying to take a reasonable precaution. (You know, lock the door to prevent casual snooping as opposed to determined thieves who can alway throw a brick through your window.)

Footnotes:

1. Normally, it's dangerous to assume things about the platform a visitor is using. However, this particular script will only be run by selected users, who are all running Win32 or some variation. The project manager said to assume Win32. I'm not happy with the decision, but that's what the project manager wants. *Sigh*

   I only mention to let know know that a) I know it's dangerous and b) it's something I'll address in a later update.

2. $cfg is a hash containing basic configuration information, as discussed previously.

Thanks in advance...

--f