Lawrence
Novice
Jan 23, 2001, 12:59 AM
Post #1 of 4
(844 views)
|
|
eval() security
|
Can't Post
|
|
For a particular program I'm working on, it will be helpful to be able to eval() user input.
Now if your pulse just rose 200 bpm, it's ok, I am aware of the glaring security risks. What I'm trying to do is let the user enter things such as equations so as to return a value that can be plugged into a HTML template and printed to the browser. If there's a better way than eval (such as a module that handles this sort of thing), then I really want to hear it. Otherwise, I'm looking at eliminating the security issues from evalling user input.
Here's what I propose:
1. Remove all backticks (`) and pipes (|) from the input (note, || could be useful, but we're only talking simple evaluations, so "or" would suffice).
2. Remove all barewords, and therefore functions from the input (there may be some useful functions like sin and cos that could be useful, it would be easy enough to keep them).
3. Remove any variables (those starting with $, @ or %) - could typeglobs be a problem? Removing them would require some discretion, so as to avoid the multiplication symbol (come to think of it, % inteferes with modulus too)
3. Double over to be sure of removing some particularly nasty functions like system, exec and unlink, and also file handling functions.
4. I was also pondering whether removing all whitespace would help? But that's probably covered already (the reason being that two consecutive function calls could be eliminated by removing the space between them, but that could also create new problems if the user entered "un link" for example).
Any thoughts? I'm just wondering if you think that those ideas will work, and anything that I should perhaps change or add. Or, of course, if there's another way entirely (that can handle equations and conditional expressions).
Thanks.
|
MAIN
SEARCH
WHO'S 
LOG 