week #9

How did you do last week's assignment?

You can take a look at a module approach to the data parsing problem by submitting the test form at http://clam.clamcenter.org/MINK_TCP_COM/testparse_module.html. This program is at http://clam.clamcenter.org/MINK_TCP_COM/parsedata_module.cgi, so feel free to make your own forms submit to it. You might like to see the CGI code for that as well as the ParseMe.pm module it uses.

You can view a page that displays its last five visitors but doesn't do much else. You probably also want to see the code for that.

Where can I learn about writing secure CGI scripts?

• Safe Scripting in Perl by Lincoln Stein

  This is the guy who wrote CGI.pm, which we'll be learning about next week!

• General WWW Security FAQ from w3c by Lincoln Stein

  This is the main page the above CGI information is taken from. Most of this stuff is written from a server administrator's point of view, but you should probably get an idea of the issues involved for future use. Your specific responsibility at the moment is to "not write dangerous CGI scripts that would cause a problem IF my server administrator left holes open." That's covered in the previous specific section.

• CGI/Perl Taint Mode FAQ by Gunther Birznieks

  The basics of taint mode!

• Programming Perl, pp. 356-363 (from Chapter 6)

  This talks about tainting. Pay special attention to the detailed example on page 357. We'll be going over this tonight.

• The Perl Cookbook Recipe 19.4 - Writing a Safe CGI Program

  This talks about the basics of tainting.

• The Perl Cookbook Recipe 19.6 - Executing Commands Without Shell Escapes

  Even if you have cleaned out all your tainted variables, it's still a good idea to avoid passing them to the shell. This recipe tells you how, with the "list of arguments" form of system and exec. It also describes how you might open a pipe to a child process and then print directly to the child via the pipe.

What should I do for next week?