Beefy Boxes and Bandwidth Generously Provided by pair Networks
P is for Practical
 
PerlMonks  

Re: request for review: file reading security

by cchampion (Curate)
on Sep 05, 2004 at 10:45 UTC ( #388590=note: print w/ replies, xml ) Need Help??


in reply to request for review: file reading security

It isn't only the security. Your line $req = 'index' if -e $req; will make all requests invoke "index". Your code means " assign to 'index' if a file named $req exists". I am not sure what you wanted to achieve that way, but here is how I would do it.

use strict; use warnings; my $req = $ENV{QUERY_STRING}; # limits the applicability. Only lowercase file names $req = lc $req; # remove all unwanted characters from the beginning of the string. # In this example, everything except alphanumerics # and underscore is removed. $req =~ s/^[^a-z_0-9]+//; # remove an extension, if any $req =~ s/\.html$//; # default value is the index my $page = "pages/index.html"; # if the page exists, then we use it $page = "pages/$req.html" if -e "pages/$req.html" ;

Also, consider using CGI param instead of reading the environment.

HTH


Comment on Re: request for review: file reading security
Select or Download Code
Replies are listed 'Best First'.
Re^2: request for review: file reading security
by Anonymous Monk on Sep 05, 2004 at 14:32 UTC
    Your line $req = 'index' if -e $req; will make all requests invoke "index"

    no it won't.

    The QUERY_STRING should not match anything, since the filename would be composed as pages/QUERY_STRING.html That's why if it matches any file, it should roll back to a default.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://388590]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others examining the Monastery: (21)
As of 2015-07-28 19:46 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    The top three priorities of my open tasks are (in descending order of likelihood to be worked on) ...









    Results (258 votes), past polls