Beefy Boxes and Bandwidth Generously Provided by pair Networks Joe
more useful options

(Ovid) Re(2): How many bugs can *you* find

by Ovid (Cardinal)
on May 01, 2001 at 01:55 UTC ( #76778=note: print w/ replies, xml ) Need Help??

in reply to Re: How many bugs can *you* find
in thread How many bugs can *you* find

turnstep wrote:

Please tell us this is not production code being used somewhere. Please?

Unfortunately, I can't tell you that. It is being used. It's in a script that is over 2,000 lines long and does not use strict. I added use strict and an extra 130 lines were added to the error log. As usual, I don't have a lot of time to fix this, and it's called from several different places. My only change at this point was to plug a nasty security that tinman alluded to:

Umm.. a biggie, but I don't think you're untainting any of the file name variables or the param variables that you recieve from the user... so a script kiddie style "rm -rf" hack is possible..


Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

Comment on (Ovid) Re(2): How many bugs can *you* find
Re(3?): How many bugs can *you* find
by turnstep (Parson) on May 01, 2001 at 02:11 UTC

    Well, in that case, if you have to put up with 2000 lines, I can put up with these few. :)

    ## Implicit: htmDir no longer ends in a slash use strict; ## Yay!! sub updateTiles() { my $tilefile = "$htmDir/tile.htm"; open(TILE, "$tilefile") or die "Could not open $tilefile: $!\n"; my $tileinfo; { local $/; $tileinfo = <TILE>; } my $section; for $section (qw(Tile Pile Link)) { my $contentTemp = $query->param($section); ## Clean up, aisle seven $contentTemp =~ y/A-Za-z0-9_\n//cd; if ($section eq "Pile") { $contentTemp =~ s#\n#<P></P>#g; } elsif ($section eq "Link") { my $searchterm = $contentTemp; ## Even stricter here: $searchterm =~ y/a-z//cd; $contentTemp = qq{<IMG SRC="images/enter.gif" WIDTH="8" HEIGHT="12">}. qq{<A HREF="cgi-bin/show.cgi?action=showTiles&tileType=Search}. qq{&searchFor=$searchterm">View this month's tiles.</A>}; } ## Ugh...I am not going to touch this. $tileinfo =~ s/<!--$section-->(.*)/<!--$section-->$contentTemp/; } ## Should probably write a new file and copy/rename but: ## File locking anyone? :) open(HOME,">$tilefile") or die "Could not write $tilefile: $!\n"; print HOME $tileinfo; close(HOME); my $image = $query->param('Image'); if ($image =~ /^[A-Z0-9_]$/i) { my $newFile = &fileUpload('Image',250000,1,'latest_image', 'JPEG','.jpg','.jpeg'); } }

    Update: Thanks to merlyn for the catch with the brackets. Now fixed. $Deity help the rest of the 2000 lines however.

        Oops! Yeah, that started as a substitution, but then I changed it to a transliteration and forgot to remove those brackets. :)

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://76778]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others musing on the Monastery: (10)
As of 2014-04-19 15:36 GMT
Find Nodes?
    Voting Booth?

    April first is:

    Results (482 votes), past polls