|We don't bite newbies here... much|
Re: securing codeby damian1301 (Curate)
|on Aug 11, 2001 at 22:46 UTC||Need Help??|
You should always use Taint checking when dealing with CGI scripts or scripts that interact with the server. Plus, its just a good habit to get into anyway. Taint checking doesn't allow any information from outside of the Perl program (parameters, ENV vars, etc) to be used in certain functions or in system calls. Example: This will die under -T:
After running this, even without anything in @ARGV, it will give you an error like:
Now that you (partially) understand taint checking, always be sure to add warnings as well. You do this by just adding the -w flag to your shebang like so:
Now that script has warnings and taint checking activated.
What warnings does is make it easier to debug your program. If you are above 5.006 then you can just add use warnings; to your script.
Ok, now, another problem with your script is taht you dont use strict;. There are many articles on it, so here are some perllib and strict.pm.
Another problem with your script is that you don't check to see if your program opened up one of the many files correctly. You also don't check to see if they close correctly. You can help yourself and your program by adding this to your open and close calls:
This way it will check to see if they did what they were supposed to do and save you some problems later.