In this node, the monk recommended that someone check out Perl guestbooks at http://cgi.resourceindex.com. I went out and downloaded one of the guestbooks and quickly scanned the code. It's abysmal. No taint checking, no strict, no CGI.pm. The author tries to handle the CGI parsing himself and (as usual) does so incorrectly. What's worse, the following notice is included in the programs:
What that means, in a nutshell, is that you are explicitly forbidden from making the code robust and secure.# Scripts VIZBOOK.CGI, VIZADMIN.CGI, TESTBIN.CGI, MAKEDIR.CGI, PICLOAD +.CGI, # # and VIZADMDEL.CGI were written (c) by Ron F Woolley, Melbourne Austr +alia. # # Copyright 1999,2000. These scripts CANNOT BE ALTERED for personal si +te use # # OR commercial site use except as instructed here in, NOR can whole o +r # # portions of code be copied, AND, + # # all of the header notices in the scripts MUST REMAIN intact as is, A +ND, # # using the scripts without first reading the README file(s), is prohi +bited. # # IF YOU DO NOT AGREE, destroy all files NOW! + #
Please, check the code you recommend. I'm not saying that you should take huge, complex systems that have been written and do a line-by-line analysis, but at least verify the basics: taint, strict, CGI.pm, or whatever else is appropriate.
Cheers,
Ovid
Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Don't blindly recommend code
by davorg (Chancellor) on Mar 26, 2001 at 14:34 UTC | |
|
(Ovid) Re: Don't blindly recommend code
by Ovid (Cardinal) on Mar 26, 2001 at 18:56 UTC | |
by davorg (Chancellor) on Mar 26, 2001 at 19:04 UTC | |
by chromatic (Archbishop) on Mar 26, 2001 at 22:43 UTC | |
|
Re: Don't blindly recommend code
by Elias (Pilgrim) on Mar 26, 2001 at 13:49 UTC | |
by jeffa (Bishop) on Mar 26, 2001 at 21:00 UTC | |
|
Re: Don't blindly recommend code
by dws (Chancellor) on Mar 26, 2001 at 23:41 UTC | |
|
Re: Don't blindly recommend code
by alfie (Pilgrim) on Mar 26, 2001 at 14:50 UTC | |
by Ovid (Cardinal) on Mar 26, 2001 at 18:38 UTC | |
by tilly (Archbishop) on Mar 26, 2001 at 18:32 UTC | |
by bbfu (Curate) on Mar 27, 2001 at 04:51 UTC |