Web Security and Commerce

Specific Rules for Specific Programming Languages

This section gives some rules for specific programming languages.

Rules for Perl

1. Use Perl’s tainting features for all CGI programs. These features are invoked by placing the “-T” option at the beginning of your Perl script.

   Perl’s tainting features make it more suited than C to CGI programming. When enabled, tainting marks all variables that are supplied by users as “tainted.” Variables whose values are dependent on tainted variables are themselves tainted as well. Tainted values cannot be used to open files or for system calls. Untainted information can only be extracted from a tainted variable by the use of Perl’s string match operations.

   The tainting feature also requires that you set the PATH environment variable to a known “safe value” before allowing your program to invoke the system( ) call.

2. Remember that Perl ignores tainting for filenames that are opened read-only. Nevertheless, be sure that you untaint all filenames, and not simply filenames that are used for writing.

3. Consider using Perl’s emulation mode for handling SUID scripts safely if you are running an older version of UNIX.

4. Always set your program’s PATH environment variable, even if you are not running SUID or under UNIX.

5. Be sure that the Perl interpreter and all of its libraries are installed so that they cannot be modified by anyone other than the administrator. Otherwise, a person who can modify your Perl libraries can affect the behavior of any Perl program that calls ...