>>>>> "Earl" == Cahill, Earl <[EMAIL PROTECTED]> writes:
Earl> I am working a blogging utility that needs to be templated, and have been
Earl> pondering allowing users to use their own templates. The user's templates
Earl> would exist in their own directory, but they won't be chrooted there. I
Earl> know I shouldn't turn on EVAL_PERL, or ABSOLUTE, and I should have RELATIVE
Earl> turned on. Hoping that users don't have access to change those settings
Earl> from a page being evaluated.
Earl> Just wondering about the security implications, if there other things I
Earl> should do, and if there are sites out there that process pages provided by
Earl> untrusted users.
Well, if they have access to regex (via SCALAR.match, for example),
they've got access to all of Perl, if they're clever:
foo.match('$x[system "rm -rf /"]');
That's at least one hole. :)
--
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<[EMAIL PROTECTED]> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!
_______________________________________________
templates mailing list
[EMAIL PROTECTED]
http://lists.template-toolkit.org/mailman/listinfo/templates
