in reply to RE: Re: directory list
in thread directory list

my $dir = $q->param('imageDir') ?  
          $q->param('imageDir') :  
          '\images'; # or some other default. 
 
die "Illegal directory name '$dir'" unless -d $dir; 
chdir( $dir ) or die "Couldn't cd to '$dir', $!";

[download]
I'm not sure I'd ever install a CGI script that took an unrestricted directory name from a parameter! Danger, Will Robinson!

-- Randal L. Schwartz, Perl hacker

Replies are listed 'Best First'.
RE: (4) directory list
by Adam (Vicar) on Sep 21, 2000 at 02:15 UTC
    I disagree. There is no danger in that script. Granted I didn't do much of a test, but at least I check that it is really a directory. How much damage can a script do trying to change directory and glob for known extensions? Not much. In fact the only "risk" I can see would be some one looking to see if given directories exist on your server. Not that big a deal. Nor would it take much to add a regex after the -d line to make sure the user supplied directory is sanctioned.

    Calm your alarms merlyn, they are not needed here.

[reply]
      One danger that occurs to me off the top of my head is "borrowing code". When we need to write a quick script, how often do we say "Oh! I have some code that will do that" and take that code and modify it. If I grab your code to make a list of all files and I don't realize it's insecure, I could be revealing information that I don't want to.

      Another issue would be with crackers. Part of their job breaking a system is to gather as much data as possible. With your script, they can test for any directory they want. That could be great information. Always give as little as possible and loosen up later.

      Cheers,
      Ovid

      In the jungle of the World Wide Web, the paranoid /(wo)?man/ is: defined $1 ? "queen" : "king" ;.

      Join the Perlmonks Setiathome Group or just go the the link and check out our stats.

[reply]
      Sure there is. Suppose you have a directory of images that only registered users of your site should be able to see. You've just bypassed all your webserver's authentication and authorization mechanisms!

      And even if you, Adam, understand the limitations, you didn't document them, leaving the onlookers with a potentially dangerous security hole in their environment.

      No, I don't think I'm being an alarmist. What you posted is dangerous if cargo-culted. And believe me... it will end up where you least expect it.

      -- Randal L. Schwartz, Perl hacker

[reply]

In Section Seekers of Perl Wisdom