Re: Passing a regex from a CGI HTML form

[hippo]

Yes, there is. But doing so would be a massive security hole (because it's effectively arbitrary code execution) which is why nobody does it like that.

Perhaps this is an XY problem? Why do you want to have a user provide a function to your code - can you elaborate?

[Linicks]

Thank you for the reply.

It's a private page used by me and a co-worker at work to run a football competition every week for work mates.

The data is scraped (manual copy 'n' paste) from a newspaper site and as the data now is produced on the fly, it is in a real mess - my code 'as is' now parses this and puts it in the format we require

Now, the issue is, every week or so, they change something, and my parser breaks (which can be fixed easily when I am at home!), but I am at work, so need a way to add new subsitutions on the fly otherwise all hell breaks lose at work when the results are late!

Basically, it's just a fail safe 'in case' and NO security issues at all raise their heads as it is only me doing the input :)

Thanks, Nick

[AnomalousMonk]

... NO security issues at all raise their heads as it is only me doing the input ...

"Unfortunately, Dave, that sounds a lot like Famous Last Words." :)

[Linicks]

I know what you mean, but it is only me that knows the page address (it's on the Internet, but no way can anybody know the address, let alone guess it) - let alone do the input.

Nick

[haukex]

Hi Linicks,

Doing an eval or s///ee with a value supplied by a user on an HTML form is the equivalent of giving that user shell access to the machine. You keep saying that only you know the address of the machine, but if security by obscurity is your only security, then one day, for example if your page is discovered by a crawler, that'll mean game over for your server. That's why everyone has been saying to be very careful with eval and security by obscurity, and they are right!

To make one more recommendation because I don't think it's been made yet: At least throw some HTTP digest authentication on there along with the SSL.

Hope this helps,
-- Hauke D

[Linicks]

Hi Hauke D,

Thanks for the reply. I have now implimented a bit of 'magic' in the form to only allow the script to be processed if known.

As to web crawlers, how can a crawler 'slurp' a page that isn't advertised anywhere?

Lastly, something that nobody mentioned here - OK, using 'eval' and the like is equivalent to giving shell access, but surely it will only be as the UID/Group I run apache under?

Thanks, Nick