hide perl script

[harangzsolt33]

In the previous question, SearchigPerl says that his perl scripts just download instead of getting executed on the web server. This got me thinking...

if your scripts process online payments or perform some encryption or some secretive stuff, it would be a nightmare scenario if your server allowed people to see your perl source instead of executing it!

My question is how can a perl programmer avoid something like that? Is there a way to make sure that a page stays hidden in case it gets downloaded? For example, I tried to put a null character as the first byte in one of my scripts to make sure that the rest of the data will not download or stays hidden in case it doesn't get executed by the server. But it turns out I get a 500 Internal Server error when I try to execute my script. The server doesn't like when a perl script starts with a null character. Lol

Of course, I could try to obfuscate my perl script, but that's not a really foolproof idea. If someone really wanted to figure out what my script does, and they've got my source code in hand, it's just a matter of time before they figure out what it does.

[dsheroh]

Even if we presume that you have insufficient control over the web server configuration to ensure that CGI scripts will be executed instead of sending the source code...

...and even if we accept that you have to use CGI instead of a more modern web application architecture...

...and even if we ignore the fact that good encryption and payment processing systems remain secure even when the algorithms are fully public...

...this still isn't a problem if you're using good software development practices.

Good development practice calls for putting potentially-reusable code into modules, not the main program source file. So you're running something as a CGI script and the web server sends the source instead of running it, but the source of myapp.cgi consists of:

#!/usr/bin/perl
use MyApp::Main;
MyApp::Main->run();

So the bad guys saw that? Whoopty-freaking-do. The only thing it tells them is that your knowledge of CGI application development isn't stuck in 1997.

Good web application deployment practice also says that MyApp/Main.pm (i.e., the source of your MyApp::Main module) must not be placed under your web root (or any other web-shared directory), which ensures that there is no URL which maps to that file, thus making it impossible for a web user to access the source code of the module(s) used by your program. (Barring a serious exploit of the web server itself, of course.)

[ikegami]

Web servers don't magically start returning the source code instead of executing the script. Test changes to the config before making them in production, and test your changes in production after making them.

You could add a level of indirectness by making your scripts setuid scripts and removing group-read and other-read permissions. This has the added advantage that your data files need not be readable by the web server account anymore.

[Your Mother]

if your scripts process online payments or perform some encryption or some secretive stuff, it would be a nightmare scenario if your server allowed people to see your perl source instead of executing it

Only if your code is buggy or your security practices are bad. Granted it's certainly not desirable to give hackers a view of your code because they may notice weaknesses you did not or find shortcuts to making brute force attacks affordable but assuming correct code and proper practices, it makes no difference. If it did, all open source applications would be inherently insecure.

[ikegami]

Security vulnerabilities isn't the only concern; web apps contains plenty of trade secrets

[Your Mother]

Of course, but that does not seem to be the concern here; payment info or encryption leaking.

[jimpudar]

As ikegami has explained, if your server is returning your source code, that means your server is misconfigured.

However, there are legitimate reasons for wanting to prevent your users from reading your proprietary Perl code.

For this, I would recommend taking a look at Filter::Crypto module on CPAN.

Do note that once someone obtains the source code, there is really nothing you can do to completely prevent them from decrypting it:

In general, it is hopeless to try to prevent everyone from getting at the source code, especially when it is being run in an environment that you have no control over, and even more so when the software running it (Perl) is open source itself.

This technique can never completely hide the original unencrypted source code from people sufficiently determined to get it. The most it can hope for is to hide it from casual prying eyes, and to outdo everyone who is using a precompiled perl (at least from "regular" sources) and everyone who is not knowledgeable enough to suitably modify the Perl source code before compiling their own.

Best,

Jim

[karlgoethebier]

"...nightmare scenario...obfuscate my perl script..."

Acme::Bleach and/or snail mail for the rescue.

In other words: I guess something different went wrong.

Best regards, Karl