Beefy Boxes and Bandwidth Generously Provided by pair Networks
Syntactic Confectionery Delight
 
PerlMonks  

Best way to untaint

by Anonymous Monk
on Jun 24, 2004 at 13:19 UTC ( #369342=perlquestion: print w/ replies, xml ) Need Help??
Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Hi!, I have two questions:

1) If I have a.cgi which posts to b.cgi, what is the best way to untaint? I have been using this:

param('firstname') =~ /^([a-zA-Z]+)$/; my $u_firstname = $1; param('lastname') =~ /^([a-zA-Z]+)$/; my $u_lastname = $1;
But I see that lastname could have been bogus, in which case I will have u_lastname be the same as u_firstname, when I'd prefer to let the user know what they entered was bogus.

2) If I have 3 cgi's. a posts to b and b posts to c, how can I make a's params available to c?

gratci, me

Comment on Best way to untaint
Download Code
Re: Best way to untaint
by Tomte (Priest) on Jun 24, 2004 at 13:35 UTC

    1) Always check for success of your match-operators:

    my ($u_firstname, $u_lastname) = ("Bogus", "Bogus"); if (param('firstname') =~ /^([a-zA-Z]+)$/) { $u_firstname = $1; } else { # handle bogus case } if (param('lastname') =~ /^([a-zA-Z]+)$/) { $u_lastname = $1; } else { # handle bogus case }

    2: do you redirect, or do you use internal requests? in both cases appending the parameters that need to be passed on to the query-string of the url you redirect to/process internally should work; if you do internal requests, use LWP::UserAgent and POST the requests with the needed parameters added according to the respective documenation.

    regards,
    tomte


    An intellectual is someone whose mind watches itself.
    -- Albert Camus

Re: Best way to untaint
by Abigail-II (Bishop) on Jun 24, 2004 at 13:43 UTC
    You should first check if the match succeeds, then do the assignment. Something like:
    die "Horribly" unless param 'firstname' =~ /^([a-zA-Z])+$/; my $u_firstname = $1; die "Horribly" unless param 'lastname' =~ /^([a-zA-Z])+$/; my $u_lastname = $1;

    As for answer 2, a needs to pass its information to b, and b needs to pass that information to c, in whatever form is most convenient to you. Either encoded in the URL (could be in the path, could be in the query (which is what happens if a browser does a GET form request)), or in the body of the request (which is what happens if a browser does a POST form request). Or you could use smoke signals if you have a fire and a smoke receiver.

    Abigail

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://369342]
Approved by Old_Gray_Bear
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (10)
As of 2014-07-10 13:55 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    When choosing user names for websites, I prefer to use:








    Results (211 votes), past polls