the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 739
Sockets
After a socket is created using socket, it is connected to a remote host via a call
to connect, which takes a sockaddr_in structure composed of the target’s host
and port details. If this host information is user-controllable in any way, the
application may be exploitable to cause network connections to arbitrary hosts,
either on the Internet or on the private DMZ or internal network on which the
application is hosted.
Configuring the Perl Environment
Perl provides a taint mode that helps prevent user-supplied input from being
passed to potentially dangerous functions. You can execute Perl programs in
taint mode by passing the -T flag to the Perl interpreter as follows:
#!/usr/bin/perl -T
When a program is running in taint mode, the interpreter tracks each item
of input received from outside the program and treats it as tainted. If another
variable has its value assigned on the basis of a tainted item, it too is treated as
tainted. For example:
$path = “/home/pubs”
# $path is not tainted
$filename = param(“file”); # $filename is from request parameter and
# is tainted
$full_path = $path.$filename; # $full_path now tainted
Tainted variables cannot be passed to a range of powerful commands, including
eval, system, exec, and open. To use tainted data in sensitive operations,
the data must be “cleaned” by performing a pattern-matching operation and
extracting the matched substrings. For example:
$full_path =~ m/^([a-zA-Z1-9]+)$/; # match alphanumeric submatch
# in $full_path
$clean_full_path = $1;
# set $clean_full_path to the
# first submatch
# $clean_full_path is untainted
Although the taint mode mechanism is designed to help protect against many
kinds of vulnerabilities, it is effective only if developers use appropriate regular
expressions when extracting clean data from tainted input. If an expression is
too liberal and extracts data that may cause problems in the context in which it