Malicious command check 3

[jouell]

IS there a module or a set of filters I can run against
a value to check and see if it is a malicious commmand?

Say for example I get data from a cgi or a shell scipt and want to make sure no 'rm -rf' or 'safe command; rm -rf' commands have been entered. Does such a thing already exist?

-John

 

[KevinADC]

you can use taint mode and your perl script will bark before trying anything dangerous with tainted datat from a form or other input sources.

#!/usr/bin/perl -t

 

[jonadab]

> IS there a module or a set of filters I can run against
> a value to check and see if it is a malicious commmand?

Any such module would be highly bug-prone, because of the large number and wide variety of potential malicious commands. It's much safer to take the opposite approach: don't directly execute *any* commands that come from an untrusted source. If you need to allow an untrusted source to trigger command events, hard-code the commands that are acceptable. You will probably need to accept *arguments* for those commands, though, but, again, rather than disallowing specific malicious inputs, take the approach of allowing only inputs you believe to be safe. For instance, if you are accepting user input that gives the name of a directory, within some larger directory structure that your program uses, the filter-out-malicous-stuff approach would be to specifically check for things like starting with / or containing ../ but the safer approach is to decide what characters you want to _allow_ in the directory name (e.g., alphanumeric characters only) and accept only those and nothing else.

Be particularly wary of calling a shell to expand your commands, as shells have a large number of metacharacters and escapes they can be fed that will cause them to do stuff you might not want. Use the multi-argument system command, as in system('somecommand', $arg1, $arg2); Or even better, do things in pure Perl when you can.