Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl: the Markov chain saw
 
PerlMonks  

Re^2: Dangerous Characters for system calls

by graff (Chancellor)
on Apr 14, 2014 at 02:49 UTC ( #1082182=note: print w/replies, xml ) Need Help??


in reply to Re: Dangerous Characters for system calls
in thread Dangerous Characters for system calls

Sorry if this reply is coming too late to be helpful. The situation you describe, of printing the text from the form directly into a pipeline of chained commands, could be relatively risk-free, provided that the commands behave reasonably well when presented with untrusted input on stdin.

That is, if "commanda" and "commandb" really are just (fairly robust) stdin-stdout filters - and if the strings to run those commands are fully defined in your code (i.e. do not contain untrusted strings from the web form), then you won't really be exposing any untrusted data as part of a command line.

Obviously, if "commanda" or "commandb" are not robust when given untrusted input (e.g. if they assume line-oriented input but don't know how to handle really long input lines, or they assume ASCII-only input and do unpredictable things with non-ASCII data), then your process is still facing risks, unless you filter the data appropriately before writing it to the pipe.

  • Comment on Re^2: Dangerous Characters for system calls

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1082182]
help
Chatterbox?
[james28909]: i forgot how to link my scratch pad
[Lady_Aleena]: [pad://]
[james28909]: my scratchpad
[james28909]: and like i say, is just an example, not working code, but hopefully you understand what i mean. :)
[james28909]: and like i say, it would be alot of work to get around renaming 3 subs haha
[Lady_Aleena]: Well, you would have to add the file munging and a lot more.
[james28909]: yeah but it would rename those subs xD
[Lady_Aleena]: I'd say, go back to my scratchpad, and really look at what the 3 subs are doing, then play. Meanwhile, I am going afk for about an hour +/- a few minutes.

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (6)
As of 2017-05-24 05:22 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?