Re: Can System() of Perl be bypassed?

From: Ilya Martynov (ilya@martynov.org)
Date: 01/22/03

  • Next message: Glynn Clements: "Re: Can System() of Perl be bypassed?" 
    To: Sandeep Giri <sandeepgiri@indiatimes.com>
From: Ilya Martynov <ilya@martynov.org>
Date: Thu, 23 Jan 2003 01:09:56 +0300

    >>>>> On 22 Jan 2003 07:03:27 -0000, Sandeep Giri <sandeepgiri@indiatimes.com> said:

    SG> Hi All,
    SG> In my PERL code,I am using user's input as command line argument for the
    SG> program being executed by System().

    It depends. Perl's system() may be given a single string as its
    argumens or a list. In the first case it will pass this string to the
    shell which will try to interpret it. For example

        system("cat $file");

    This is dangerous as $file can contain something that will interpreted
    by shell as an additional commands. For example $file might containt
    something destructive as '; rm -rf /'.

    If you specify a list than system() doesn't use shell and it's usage
    is much safer:

        system('cat', $file);

    This will try to only print file specified by $file variable no matter
    what $file contains.

    It is actually is covered in Perl documentation. See 'perldoc -f
    system'.

    Still if you let arbitrary user input as an argument to some program
    you must be sure that this program will be able to handle it in safe
    manner. Personally I would ensure that user imput is clean and is
    something that the program expect before passing it to the program. It
    is just safer.

    SG> Can user run command of his choice by giving malicious input?
    SG> Is PERL's -T (Taint mode) the solution for this?

    Yes and no. Taint mode helps you to catch bugs when you pass arbitrary
    user input to system() by accident. Perl simply refuses to use tainted
    vars as arguments for system(). But if you willingly untaint it
    without actually verifing and removing bad dangerous data and then
    pass it to system() then Perl cannot help you. You are on your own
    here.

    You might want to read 'perldoc perlsec' to learn more about taint
    mode. 

    -- 
Ilya Martynov,  ilya@iponweb.net
CTO IPonWEB (UK) Ltd
Quality Perl Programming and Unix Support
UK managed @ offshore prices - http://www.iponweb.net
Personal website - http://martynov.org

    Relevant Pages

    • Re: Wait for background processes to complete
      ... To be able to execute commands in the background and wait for their ... The documentation I am referring to is http://perldoc.perl.org/. ... You can run a command in the background with: ... There is a general problem with perl documentation: ...
      (comp.lang.perl.misc)
    • Re: Perl For Amateur Computer Programmers
      ... >professional computer programmers could use with the same ease as Basic. ... >Perl For Amateur Computer Programmers ... Also, taking into account that you're appealing to "scientists", it ... Also, as a side note, you seem to use the noun "command" in a naive ...
      (comp.lang.perl.misc)
    • Obtaining complete Unix command line that evoked script as string
      ... If there is a more appropriate list for this, let me know; the other perl lists I've seen seem to specialised for this. ... Note this is not just the arguments of the call to the script, but everything including pipes and redirects, etc., e.g. ... Ideally the perl interpreter would grab the complete command line as its evoked and I'd access this via a variable. ...
      (perl.beginners)
    • Thanks for the comments Jan. 25, 2006
      ... "shadow" operating system which is running behind Windows. ... Perl can then collect data from that program and do ... that by sending longer strings etc. to the Windows clipboard and then having ... SendKeysuse a Ctrl V command to paste the information to the text editor ...
      (comp.lang.perl.misc)
    • Re: debugger exiting
      ... strict and warnings pragmas. ... I think portraying Perl as a command-line tool limits it to fewer platforms than ... work only as a Unix shell command line. ...
      (perl.beginners)