>sjat_private wrote: >>I think some filtering after the line '$q = new CGI;' would help a little >> >>Eg. >> >>my $SECMSG = 'Pliz dont hekk us\n"; >> >>if(!defined $q->param('cfg')){ die "missing cfg file\n"; } >>my $xx = $q->param('cfg'); >> >>if($xx =~ /\.\.|\/\/|\.\//){ die $SECMSG; } >Eek! leaning toothpick syndrome! > > if ($xx =~ m"\.\. | # if match '..' anywhere, or > // | # match '//' anywhere, or > \./ "x) { # match './' anywhere: > die $SECMSG; > } > >Of course, as a general rule, it's better to take a leaf out of the >firewall admin's book: deny everything by default, then allow only >specific, known good patterns. For example, isn't this code prone to >fragility in the presence of hex-encoded characters? Yes, great advice. also watch out for flying \'s. Even though you are filtering which is good, one mistake can make your perl dirty and of little worth. Setting $q->param('cfg') to .\.\/ will make it past these filters and hekk you. A nice way of filtering is to filter out meta characters first, then the double dot, or the best method - "deny everything by default". _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
This archive was generated by hypermail 2b30 : Thu Feb 07 2002 - 14:29:37 PST