Why aren't these equivalent?

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

I'm trying to pass a file name to a cgi script that will then delete the file. It seems that I'm getting the file name passed correctly, but retrieving it with the CGI.pm param() call doesn't seem to work with unlink(). However, explicitly assigning the same file name works so it's not a problem with permissions. I tried the following two methods:

1) This method (hardcoding the path and file name) works...

    $fileName = "../../20080101.txt";
    printf ("File to be deleted: [%s]\n", "$fileName");
    unlink( $fileName );
[download]

It prints...

    File to be deleted: [../../20080101.txt]
[download]

and deletes (unlinks) the file.

2) This method (passing the path and file name as a cgi parameter, $q is a CGI object) does NOT work...

    $fileName = $q->param('deletetarget');
    printf ("File to be deleted: [%s]\n", "$fileName");
    unlink( $fileName );
[download]

It prints...

    File to be deleted: [../../20080101.txt]
[download]

but doesn't delete (unlink) the file.

Can anyone explain this?

Comment on Why aren't these equivalent? Select or Download Code

Replies are listed 'Best First'.
Re: Why aren't these equivalent? by tilly (Archbishop) on Jul 12, 2008 at 00:46 UTC
That would happen for good reason if taint checking is on. See perlsec for an explanation of that. Looking in the error logs would also be helpful. Failing that, I'd double-check your assumptions. I should note that it does not look like you're using strict.pm, and your printf is adding unnecessary complexity, that line is more clearly written as: `print "File to be deleted: [$fileName]\n";` [download] (The quotes you have around $fileName now means that it already is being interpolated.)	[reply] [d/l]
Re^2: Why aren't these equivalent? by Anonymous Monk on Jul 12, 2008 at 01:05 UTC
You are correct, tilly. I turned off taint checking and now the parameter passing method works. I'll have to look into this a little deeper, since taint checking seems to be something I want to have active. Thank you all for your quick responses!	[reply]
Re^3: Why aren't these equivalent? by massa (Hermit) on Jul 12, 2008 at 09:11 UTC
PLEASE COME BACK HERE don't, please, run CGIs without -T. As holli said below, someone will pass you "/etc/passwd" as a parameter and you will be hosed. you can unlink the file IIRC if you check it against a regex, like this: `unlink $1 if $fileName =~ /^(\.\.\/\.\.\/20\d{6}\.txt)$/;` [download] _without_ having to run it insecurely. as a plus, it will only remove the remove-able files. []s, HTH, Massa	[reply] [d/l]
Re^4: Why aren't these equivalent? by Anonymous Monk on Jul 14, 2008 at 19:06 UTC
Re: Why aren't these equivalent? by Joost (Canon) on Jul 12, 2008 at 00:42 UTC
I'm betting that you've got a permission problem, since you're probably not running the test script as the same user as the CGI script. This is one of the reasons you should check the return value of unlink(), open() etc and give a meaningful error message: `unlink( $fileName ) or die "Can't unlink $fileName: $!";` [download] "What should it profit a man, if he should win a flame war, yet lose his cool?"	[reply] [d/l]
Re^2: Why aren't these equivalent? by Anonymous Monk on Jul 12, 2008 at 00:54 UTC
That was my first thought as well. But if it was a permission problem, then neither method would work. unlink() just returns the number of files unlinked, so it returns 1 for the snippet that works and 0 for the snippet that doesn't work, in this case.	[reply]
Re^3: Why aren't these equivalent? by Joost (Canon) on Jul 12, 2008 at 01:07 UTC
So it can't for some reason unlink the file. There are two possibilities: 1. you don't have permissions. 2. the path does not point to the right file (for instance, you're in the wrong current directory). So what's in "$!" ? I did not put that code there for laughs. Anyone who wonders why some operation on a file didn't succeed and doesn't do a check + print $! gets what (s)he deserves. "What should it profit a man, if he should win a flame war, yet lose his cool?"	[reply]
Re^4: Why aren't these equivalent? by Anonymous Monk on Jul 12, 2008 at 01:41 UTC
Re^5: Why aren't these equivalent? by tinita (Parson) on Jul 12, 2008 at 14:37 UTC
Re: Why aren't these equivalent? by holli (Abbot) on Jul 12, 2008 at 05:12 UTC
Would you be so kind and tell us the url of the place where this little gem runs? I'd like to give it try with '/etc/passwd'. holli, /regexed monk/	[reply] [d/l]
Re: Why aren't these equivalent? by jethro (Monsignor) on Jul 12, 2008 at 00:52 UTC
To check whether Joost is right you might give delete rights to everyone for the file If that isn't the problem you might check for unprintable control-characters in the filename by printing the length of $fileName and check for problems with the current directory by printing $ENV{PWD} or by using an absolute pathname instead of the '../../'	[reply]