Re: cgi redirect

[Anonymous Monk]

So what happens when one of the form values is "; rm -rf /" or "; cat /etc/passwd"?

Much safer to use remove_tree from File::Path instead. And check your input values, because they can still refer to parent directories! (File::Spec can help you manipulate the filenames.)

[mitchreward]

I'm the only one to use this web page, that is not accessible from the internet. But yeah you're right otherwise, I'd have protected it.

[Anonymous Monk]

This is how security holes get born... maybe someday you'll open the script up for others to use, or you'll be working on something for a client and remember that time you wrote this script, and just copy it over since that's the easiest solution, or ...

Better to protect it from the start. And it's not hard to do, at least throwing this in as the first line of the foreach already helps against some of the bad stuff: tr{a-zA-Z0-9_/-}{}cd (still doesn't protect against symlinks into other directories, and if you add the dot to that list, it won't protect against "..", etc.)

[Anonymous Monk]

Capture::Tiny

    use Capture::Tiny qw/ capture /;
    my($stdout, $stderr, $exit) = capture {
        system( 'rm', '-rf', @paths );
    };