security issues with an index.pl-type thing...

derek3000 has asked for the wisdom of the Perl Monks concerning the following question:

I noticed that this site uses a central script to generate the pages, and I think it's really cool and want to use it for my company's intranet. The thing is, I suspect that taint checking won't let me use the link directly as a filename for an OPEN command. So I was thinking about using a hash of functions, where the index is the name as supplied by the link, and then the value is a function opening the corresponding file. So if someone tries to manipulate the value sent to the script, it won't work because there's no index. Any suggestions as to a better way, or is this pretty good?

Thanks, Derek

Comment on security issues with an index.pl-type thing...

Replies are listed 'Best First'.
Re: security issues with an index.pl-type thing... by knobunc (Pilgrim) on Jun 18, 2001 at 18:26 UTC
That works. Basically you need to untaint the value you were passed after making sure it is valid. Checking it against a hash of valid values will do the trick, or as this site does, looking it up in a database. Make sure that you use the correct filename portion of the URL (stip off arguments, add the absolute path if needed, etc.) when you do the validation. It also might make some sense to not have a subroutine to open the filehandle, but rather just get the filename from the validator and have a standard block of code open it. -ben	[reply]
Re: security issues with an index.pl-type thing... by DrZaius (Monk) on Jun 18, 2001 at 18:36 UTC
Yes, this is the way to do it. You'd be surprised the number of sites you can compromise because you can do things like `index.pl?template=../../../../passwd`. I wouldn't even trust a regex to 'take out the ..' either as you could probably just do /etc/passwd instead. Yes, you could also regex off `^/` as well, but you'll be doing stuff like that as long as that script exists. Also consider using pathinfo or a mod_perl handler because it looks a little nicer :)	[reply] [d/l] [select]
Re: security issues with an index.pl-type thing... by derek3000 (Beadle) on Jun 18, 2001 at 19:42 UTC
thanks for the help guys...one more question: The stuff that's passed to the script as part of the link--is that passed as @ARGV? ie: `www.ourintranet.com/index.pl?node=Announcements ---------------------------------------------------------------------- +--------------- #index.pl $node = $ARGV[0]; blah blah blah; ---------------------------------------------------------------------- +---------------` [download]	[reply] [d/l]
Re: Re: security issues with an index.pl-type thing... by wog (Curate) on Jun 18, 2001 at 19:55 UTC
Yes, it is passed as `@ARGV` for a CGI script such as that (that's probably run like CGI script, though the server might need configuration to do that). However, you are probably better off using the CGI module (or, maybe, a similar module) to parse it, because the string is not in an immediately usable format, and the CGI module knows how to extract the stuff you want. (Don't reinvent the wheel!)	[reply] [d/l]