On Wed, 2009-08-26 at 14:48 -0700, Mark Wagner wrote: > On Mon, Aug 24, 2009 at 06:06, Tim Bowden<tim.bow...@mapforge.com.au> wrote: > > On Mon, 2009-08-24 at 14:46 +0200, Rob Coops wrote: > > > <snip> > >> In your case where you run the script from a command line you will still > >> want to make sure that a user is not for instance printing a socket or some > >> part of the memory. > > > > The -f test returns true if the argument is a 'regular' file, and false > > if it is not a regular file. I guess what I'm really asking is what > > exactly constitutes a regular file? > > > >> I could quite possibly send you a string that will not > >> fail your test, but will also execute a very bad command. > > > > That would be very interesting to see. What sort of file would be > > 'regular' but still do something very bad? > > Depends on what you're doing with the file. A decade or so ago, a > popular Perl-based forum system accidentally let remote users retrieve > any arbitrary file, including (in the most popular attack) the forum's > username/password list.
First off I'm reading the file in binary mode (dataflex 3.2/ Powerflex 5.0 database files) and trying to (a) parse the 'header' section of the file to determine the record structure then (b) extract some data records from it. Then I'm using the user provided filename and appending a .ext to it and writing the records out to the new text file (probably fixed field lengths or such). This isn't a cgi app (and would take a big re-write to make it so), rather cli so I'm not interested in trying to enforce permissions beyond what the OS allows the user to do. If the user can read a file, I'm happy for the script to try and parse the file. I'm testing that the file is 'normal' with -f, and hoping that is enough to weed out any 'problematic' filenames for the new file. If the user wants to do something malicious, I don't see them getting elevated privileges from this script (am I not paranoid enough? Maybe I shouldn't care, they won't be running it on my system :-0). My other concern is how this will work on non *nix systems (I guess that mostly means windows), because all going well I'd like to put the code out there for others. In any event, I won't be testing it on other platforms. All this of course depends on me writing another little helper script (mostly done, I *think*) to help me fully nut out the binary format; The files I have (powerflex 5.0 .dat) don't seem to be fully compliant with the dataflex 2.3 file format they were originally based on for which the specs are (mostly?) available. *sigh* Tedious. Regards, Tim Bowden -- To unsubscribe, e-mail: beginners-unsubscr...@perl.org For additional commands, e-mail: beginners-h...@perl.org http://learn.perl.org/
