in reply to Re^4: calling external program from CGI
in thread calling external program from CGI
Enabling taint mode tells the Perl interpreter to watch your program's handling of user-entered data and refuse to do anything unsafe with it. The Anonymous Monk who originally answered was attempting to point out, with his suggestions of taint mode and that you should read perlsec (the perl security manpage), that you appear to be handling user input in an unsafe manner.
Consider the possibility that a malicious user might craft his input such that $myQuery holds the value ; rm -rf /. Would this not cause the shell to run test_process.pl with no input, then proceed to attempt to delete your entire file system? Using taint mode will be a great help towards preventing such errors.
To debug this, you would do well to look at your web server's error log, as it has most likely recorded perl's objections to what you requested of it. In the case of taint mode violations, this will include the location in which you attempted to do something unsafe. See perlsec for information on how to cleanse the tainted data.
As to your original question, your thought that perhaps you should call a function from test_process.pl directly rather than running it through a shell is most likely the correct course. The most effective way to do this would be to convert test_process.pl, or at least the relevant function(s), from a standalone script into a module. If you provide additional information on the script and function(s) involved, you are likely to receive reasonably detailed assistance in doing so.
|
|---|