This is my personal weblog, usually with stuff about music and other geeky things.

Thursday, March 09, 2006

CGI dump script

For my own reference, a Perl CGI script to dump out received parameters, taint mode status, and Perl's internal configuration. In order to run taint scripts on Microsoft IIS (version 5.1 on Windows XP Pro SP2) with ActivePerl I had to create a mapping (Default Web Site PropertiesHome DirectoryConfiguration...Mappings) for files with a .tpl extension to execute with C:\Perl\bin\perl.exe -T "%s" %s; otherwise I'd get an error about "-T" is on the #! line, it must also be used on the command line.

Here's the script:

#!/usr/bin/perl -wT

use strict;
use warnings;

use CGI::Pretty qw(:standard fatalsToBrowser);
use Config;

print header, start_html('CGI test page');

print p('Taint mode ON!') if is_tainted($ENV{PATH});

print h1('Received CGI parameters'), Dump if param;

print h1('Environment');
my $env_list;
foreach (keys %ENV) { $env_list .= dt($_) . dd($ENV{$_}) }
print dl($env_list);

print h1('Perl configuration');
print pre(Config::myconfig);

print end_html;

sub is_tainted {
return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 };
}

2 comments:

Randal L. Schwartz said...

Scalar::Util contains "tainted", which works a lot less harder than you did.

Mark Gardner said...

True enough, but unfortunately one of the web servers I need to use is only running Perl 5.6.1 which doesn't include that module by default. So I took an example from the Camel 3rd edition, which I've since changed to the example in perlsec since it seems cleaner.

It would be nice if I ran that server and could upgrade Perl, but then again if I ran it I wouldn't be using something like IIS.

And by the way, welcome to my blog! How'd you find me here?

About Me

My Photo
Mark Gardner
Warrington, Pennsylvania, United States
I get paid to hack code. Sometimes it even runs. I also used to play bass in a band.
View my complete profile

Previously...