Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister
 
PerlMonks  

Sanitizing user-provided path/filenames

by Fastolfe (Vicar)
on Feb 07, 2001 at 00:24 UTC ( #56767=note: print w/replies, xml ) Need Help??


in reply to Is this safe??

If you really must rely on user-provided data that maps directly to path/filenames, and can't use a token system to represent the same thing, I would explicitely declare what your valid "root" directory is, and do a check like this:

use CGI ':standard'; use File::Spec 'rel2abs'; my $ROOT = "/var/myapp/docroot/"; # wherever my $user_path = param('path'); # perhaps s/^\/+// also my $absolute = rel2abs($user_path, $ROOT); if ($absolute =~ /^\Q$ROOT/) { # $absolute is probably within $ROOT, so process it if (open(INF, "< $absolute")) { # it's here, do whatever } else { # "404 not found" } } else { # ERROR - They've tried to ../ their way out }

Keep in mind, though, that this still lets them ../ their way anywhere they want under your declared $ROOT, so if you're expecting a filename to be in a certain place or under a certain hierarchy under your $ROOT, you need to do some additional checking/tokenizing to be sure that it actually does end up there. All this code does is keep the user sandboxed.

I too highly recommend reading perlsec and using taint-checking (-T) to better prepare yourself for potentially unsafe user-provided data.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://56767]
help
Chatterbox?
[Corion]: Hmmm - Mano Negra or at least Manu Chao seem to put on a good live show. At least the one live CD I have from Manu Chao sounds good ;)
Discipulus feels the same jealousity of the johngg's daughter
[1nickt]: choroba I agree
[choroba]: Playing in a punk rock band for 20 years... my hearing is quite bad
[Corion]: I still have hopes to turn my godson and his two siblings into a punk band ;)
[Corion]: Their older sister just started piano but has been interested in drumming, which she should be able to start with 8 years or so)
[Discipulus]: ah was Kink of Bongo 1992..
[1nickt]: choroba name of band? youtube link? MySpace link?

How do I use this? | Other CB clients
Other Users?
Others meditating upon the Monastery: (9)
As of 2017-03-24 12:21 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Should Pluto Get Its Planethood Back?



    Results (301 votes). Check out past polls.