Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

(Ovid - Duking it out over security) RE(3): Warning our Fellow Monks

by Ovid (Cardinal)
on Oct 12, 2000 at 00:28 UTC ( #36310=note: print w/replies, xml ) Need Help??


in reply to RE: RE: Warning our Fellow Monks
in thread Warning our Fellow Monks

Fastolfe: you need to check for failure on your regex. Currently, if it fails and if there was a value already in $1, it will be passed to $secure. That could be disastrous. If a cracker gets your code and figures out how to pass "../../../bin/some_executable" into the previous backreference, you're back to the original problem.

Also, if the filename has a period delimited extension (and many of them do), your regex won't work (e.g. "somefile.txt").

Cheers,
Ovid

Update: I'm a moron. Fastolfe is right. Read dchetlin's response below. (sniff, sniff)

That's what I get for reading his code too fast :(

Join the Perlmonks Setiathome Group or just go the the link and check out our stats.

  • Comment on (Ovid - Duking it out over security) RE(3): Warning our Fellow Monks

Replies are listed 'Best First'.
RE: (Ovid - Duking it out over security) RE(3): Warning our Fellow Monks
by dchetlin (Friar) on Oct 12, 2000 at 03:16 UTC

    Here's the REx Fastolfe posted:

    ($secure) = ($tainted =~ /(\w+)/);

    I certainly agree that the success needs to be checked, as there's an open being called with $secure on the next line, but $secure will not be ending up with a previous value of $1; if the REx fails, it will simply be undefined.

    -dlc

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://36310]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others taking refuge in the Monastery: (2)
As of 2021-08-01 17:22 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    My primary motivation for participating at PerlMonks is: (Choices in context)








    Results (13 votes). Check out past polls.

    Notices?