Re: running an executable from a cgi script

[Angharad]

Thanks for the comments so far. I'm slightly confused though because I thought that cgi was rather 'insecure' and that forking was a safer way of running a executable via cgi even if it is a simple one

[swkronenfeld]

CGI is insecure if you use input from the user to pass into a program. For example:



Insecure CGI example:
print "Enter a command to execute:"
my $command = <STDIN>;
system($command);   # BAD!

User enters 'rm -fR *' !!!



However, in your code above, you are not taking any input. You are simply executing a program and supplying it with a file. Based on your snippet, you would do this exact same thing at a command line. You aren't giving the user any choice of what to do.

CGI can also be dangerous is you allow someone to job off processes on your machines, like you are doing above. Is this a heavy duty process? If a user bounces on the refresh button, can they start a whole lot of these jobs, and eat up system resources causing poor performance and possibly a crash? That's a problem too. Have you dealt with that in your script?

[Angharad]

OK ... I don't think the 'refresh' problem will arise.
The steps will be as follows:
A script that uploads the text file to a named directory on the server. This has already been written. This cgi script will then (hopefully) point to this script which will then call the external program.
The results of the external program will come though as a text file also.

[swkronenfeld]

So you are allowing a user to upload a text file and your executable is doing some sort of processing on that file. Then yes, you have a potential security problem.

If you're greping the text file for some keywords and printing them back...not such a big deal. If you're letting the user upload a shell script and executing it for them...red alert! So we need to know what your executable is doing with the text.