|P is for Practical|
Web form securityby earthboundmisfit (Chaplain)
|on Jul 30, 2001 at 17:03 UTC||Need Help??|
earthboundmisfit has asked for the wisdom of the Perl Monks concerning the following question:
In reading over the node, Executing a function on submit, I realized that one of my coding practices has some potential security risks.
Instead of retrieving the value of parameter values on an as-needed basis, I quite typically dump the entire contents of param() to scalars, as in:
So any form field in the HTML file automatically becomes a Perl var in the cgi script when the form is submitted.
After spending some time on this site, it occurs to me that some unscrupulous but savvy user could quite easily break a program by "hijacking" my form, i.e. downloading a local copy and modifying the field names in the form and changing the ACTION statement to a fully qualified URI.
How ruined would my day be if the following were submitted?:
I understand that a lot depends on the particulars of my script, but my generalized question is is my concern warranted or is there some sort of built in security measure in CGI.pm to handle reserved variable names? If my concern is warranted, has anyone out there come up with a bullet proof way of dealing with this?
I've read over the CGI docs and can't find anything related to this topic. (??)