This section describes ways to acquire user-supplied input, ways to interact with the user's session, potentially dangerous APIs, and security-relevant configuration options on the Perl platform.
The Perl language is notorious for allowing developers to perform the same task in a multitude of ways. Furthermore, numerous Perl modules can be used to meet different requirements. Any unusual or proprietary modules in use should be closely reviewed to identify whether they use any powerful or dangerous functions and thus may introduce the same vulnerabilities as if the application made direct use of those functions.
CGI.pm is a widely used Perl module for creating web applications. It provides the APIs you are most likely to encounter when performing a code review of a web application written in Perl.
The functions listed in Table 19-11 are all members of the CGI query object.
|Called without parameters, param returns a list of all the parameter names in the request.
Called with the name of a parameter, param returns the value of that request parameter.
The param_fetch method returns an array of the named parameters.
|Vars||Returns a hash mapping of parameter names to values.|
|The value of a named cookie can be set and retrieved using the cookie function.
The raw_cookie function returns the entire contents of the HTTP ...