Re: Is this script safe?
- From: security.department@xxxxxxxx (John Doe)
- Date: Thu, 27 Oct 2005 18:07:59 +0200
Dermot Paikkos am Donnerstag, 27. Oktober 2005 12.07:
> Hi,
>
> I wanted a script that would rename files from lower to upper case. I
> have something but I am a bit worried about going live with it as I
> can imagine there is plenty of room for error and I really don't want
> to knacker my filesystem.
>
> Could I get any comments of suggestion on what I have. I want
> something safe/secure.
>
> I am not sure about what would happen if it was passed more than one
> argument. Should I allow more than one argument?
>
> Are the any gotcha's to watch out for?
> Thanx,
> Dp.
I'd say you should additionally/eventually
- check if the move target already exists
- not allow ".." within the $dir path
- restrict $dir to a subdirectory tree
- check target file permissions and script user
- not run the script as privileged user
joe
[below the script with some additional comments]
> =============== upper.pl===============
>
> #!/usr/bin/perl -Tw
> # upper.pl
>
> # Upper case all lowercase file in a given directory.
>
>
> use File::Copy;
> use strict;
>
> my $dir = shift;
> my $found = 0;
>
> opendir(DIR,$dir) or die "Can't open $dir: $!\n";
> foreach my $name (sort grep !/^\./, readdir DIR) { # Credit Randal L.
> Schwartz
> if ($name =~ /[a-z]/) { # Look for lc file. Wot about
> files with numbers?=
This will find files and paths containing a lower character.
You probably meant
if ($name =~/^[a-z]+$/) {
respectively, since -T expects untainting by a catched value (i think ;-):
if ($name =~/^([a-z])+$/) {
$name=$1;
> ++$found;
> if ($dir !~ /\/$/) { # Add a slash if there is'nt
> one
> $dir = "$dir"."/";
> }
In short (one way of several):
$dir=~s,([^/])$,$1/,;
> (my $new = $name) =~ tr/[a-z]/[A-Z]/; # trans the
> name
Or
my $new=uc($name);
> $name = "$dir"."$name";
> $new = "$dir"."$new";
> #mv("$name","$new") or die "Can't upper $name: $!\n";
Or shorter:
#mv($dir.$name, $dir.new) or die "Can't upper $name: $!\n";
(btw, the two unnecessary assignements don't need the double quotes)
> print "$name -> $new\n";
> }
>
> }
> print "Found $found lowercase files\n"
Hopefully no big errors in my answer...
joe
.
- References:
- Is this script safe?
- From: Dermot Paikkos
- Is this script safe?
- Prev by Date: input validation and persistency module for (mod_perl) web apps?
- Next by Date: Re: Is this script safe?
- Previous by thread: Re: Is this script safe?
- Next by thread: Re: Is this script safe?
- Index(es):
Relevant Pages
|
|
