MIME::Lite

Security issues

[Maynard]

Hi there,

I'm using MIME::Lite and CGI modules to send emails from a form. Someone tried entering malicious code in to a few of our input boxes but didn't get through.

Can anyone tell me any extra security measures I should be using?

Thanks,
M.

[SeanW]

Most of the problems are on the CGI side.

Read W3's CGI Security FAQ:

[w3.org...]

#1 rule in CGI programming -- check your inputs, and remember you have no control over what you get sent (ie hidden inputs aren't)

Sean

[Maynard]

Thanks Sean, that's helpful - I will have a thorough read of that page.

So, I use CGI.pm - can someone point me to a page or give me some advice on security features of this module that I can use? Or, how do I prevent unwanted characters/symbols and file extensions (eg .exe) being entered into my input fields?

M.

[12inch]

You can do this with regular expressions.
[perl.com...]

[Maynard]

Thanks 12inch.

[Maynard]

Okay, so the security issues lie with CGI. My form consists of Name, Email and Address input text boxes only. Here's what I plan on doing. Do I need to do anything else?

1. Regular expression to exclude the following symbols ; > < & * ` ¦! $

2. T (taint) switch appended to shebang line

3. $CGI::POST_MAX = **** to limit incoming data

4. $CGI::DISABLE_UPLOADS = 1 to disable uploads

Is this enough?

Thanks,
Maynard.

[SeanW]

1. Regular expression to exclude the following symbols ; > < & * ` ¦! $

It's best to take the opposite approach, and only allow what you want, rather than excluding what you don't:

$email =~ s/[^\w@\.\+]//g; # only alphanums, @, ., and +
$onelinetextstring =~ s/[^\w \.,]//g; # similar

Works well with taint mode, too, since you have to apply a regexp anyway.

Sean