On Wed, 11 Feb 2004, Andy Wardley wrote:
> Franco Bagnoli wrote:
> > I'm working on a related tool (a wiki site), and I think that there should
> > be a collective effort in enucleating the security weakness of the TT
> > system (thanks Randal).
>
> Yes, that's a good idea. TT2 is just way too open to consider doing
> this without a full and thorough security review, and even then I think
> there's a good chance you'll miss something until too late.
[snip]
> But in the mean time, it would be an excellent idea to identify those
> features that could cause problems.
I started using Safe::World. It indeed catches systems inside array
interpolations, like "@{[system "ls"]}". I tried
use Safe::World ;
my $world = Safe::World->new();
$world->op_deny_only(qw(system));
my $vars={a=>3};
$world->set('$vars', $vars, 1);
$world->eval(q`
use Template;
my $config={};
my $template = Template->new($config);
# $a=~/@{[system "ls"]}/; # this is trapped
`);
getting:
system trapped by operation mask at
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/Template/Filters.pm
line 669.
system trapped by operation mask at
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/Template/Filters.pm
line 669.
Compilation failed in require at
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/Template/Config.pm
line 96.
I did not have time yet to examine the template code, nor I think I'll
have time in the next days (teaching time....). BTW, which are in your
opinion the most dangerous ops to look for?
--
Franco Bagnoli (franchino) <[EMAIL PROTECTED]> ([EMAIL PROTECTED])
virtual location: Dipartimento di Energetica "S. Stecco"
ultra-virtual affiliation: Centro Dinamiche Complesse (CSDC-Firenze)
real location: Dip. Matematica Applicata "G. Sansone", Universita' Firenze,
Via S. Marta, 3 I-50139 Firenze, Italy. Tel. +39 0554796422, fax: +39 055471787
_______________________________________________
templates mailing list
[EMAIL PROTECTED]
http://lists.template-toolkit.org/mailman/listinfo/templates
