Web Security, Privacy & Commerce, 2nd Edition

Rules for Programming Languages

This section provides rules for making programs written in specific programming languages more secure.

Rules for Perl

Here are some rules to follow to make your Perl scripts more secure:

1. Use Perl’s tainting features for all CGI programs. These features are invoked by placing the “-T” option at the beginning of your Perl script. Perl’s tainting features make it more suited than C to CGI programming. When enabled, tainting marks all variables that are supplied by users as “tainted.” Variables whose values are dependent on tainted variables are themselves tainted as well. Tainted values cannot be used to open files or for system calls. Untainted information can only be extracted from a tainted variable by the use of Perl’s string match operations.

2. The tainting feature also requires that you set the PATH environment variable to a known “safe value” before allowing your program to invoke the system( ) call.

3. Remember that Perl ignores tainting for filenames that are opened read-only. Nevertheless, be sure that you untaint all filenames, and not simply filenames that are used for writing.

4. Consider using Perl’s emulation mode for handling SUID scripts safely if you are running an older version of Unix.

5. Always set your program’s PATH environment variable, even if you are not running SUID or under Unix.

6. Be sure that the Perl interpreter and all of its libraries are installed so that they cannot be modified by anyone other than the administrator. Otherwise, a person ...