No. Don't use anything that starts with HTTP_ directly in a file path.
Extract the information into an untainted variable.
This is why I recommend that all CGI programs run with -T (enabling taint mode)... to keep you from making stupid dangerous mistakes like this without deliberately trying to get around it.
-- Randal L. Schwartz, Perl hacker | [reply] [Watch: Dir/Any] |
if (-e "$ENV{REMOTE_ADDR}.$ENV{HTTP_COOKIE}.txt") {
do something if file exists
}
else {
file does not exist
}
Check out How do I test if I file exists without attaching a filehandle to it?.
| [reply] [Watch: Dir/Any] [d/l] |
| [reply] [Watch: Dir/Any] |
You may also want to check that it's a file (not a directory or special file), and that it's readable and writeable. Try:
if (-e "$ENV{REMOTE_ADDR}.$ENV{HTTP_COOKIE}.txt")
{
if (-f _)
{
if (-r _)
{
if (-w _)
{
#Do stuff here
}
else
{
#Not writable
}
}
else
{
#Not readable
}
}
else
{
#Not a file
}
}
else
{
#Doesn't exist
}
You can put all the checks in the one if by anding them if you only need to check that the file exists and is accessable.
Colin Scott
If you build it, they will be dumb... | [reply] [Watch: Dir/Any] [d/l] |
(sorry for this moment of meta-commentary, but . . . )
I just want to say that I prefered the POTENTIAL SECURITY HOLE posted at 18:56 over the one posted at 18:59 because the former gave an example of what was wrong with this progging-behavior, while the latter just said "don't do it." I'm only mentioning this because I've get my prefs set to list comments by highest score, so when I first viewed the page it was the latter post which was closer to the top. I'm still fairly newbie (but aren't we all?-- man in the subject line excepted, of course.), so I super appreciate it when the more (or in this case most) knowledgable monks take the extra moment to give a concrete example of why a don't is a don't, or a do is a do. (Which is to say that I chose to ++ the 18:56 post rather than its younger brother, on account it was the older, less popular kid which helped me more. Also, I just got up a little while ago, so my clutch isn't quite engaged yet, which is why I've gone sort of graphomanic and jest keping babbbbbbbbling. sorry) Just my two cents. Carry on.
The Autonomic Pilot; it's FunkyTown, babe. | [reply] [Watch: Dir/Any] |
| [reply] [Watch: Dir/Any] |