perl cgi::param error with single plus sign in Taint mode

0
votes

I work on a website based on Perl CGI. It's run with Perl -T (Taint mode). I noticed that a text input contains just a plus sign and nothing else ("+") causes CGI::param() to give this error:

Insecure dependency in require while running with -T switch at ....../CGI.pm line 533. BEGIN failed--compilation aborted.

This does not apply to other single signs, or a plus sign with leading or trailing blanks ("-", " + ", "?").

Although users usually won't enter a single plus sign as input, I would like to have a workaround here so that my script will reject the input nicely, instead of printing an ugly "Software Error" in the browser.

REQUEST_METHOD=GET QUERY_STRING='page=%2B' perl -s -T -E'
use strict;
use CGI qw( :standard  );
CGI->new();
my $page;
eval { $page = param("page"); };
print "[ $@ ]\n";

'

This prints a compilation error:

[ Insecure dependency in require while running with -T switch at ../..../CGI.pm line xxx. BEGIN failed--compilation aborted. ]

If I skip CGI->new() there will be no error. But this is not an option according to our requirements.

I hope this is more clear. Thanks all for being helpful!

YJ

1
perlcgiparamtaint
"+" is used to indicate a space in URLs. It is needed to be encoded to "%2B" if "+" is meant. So you want to check the case if a user just sends a space? – Boris Däppen
Hi Boris,Not quite. I have no control over what the user sends. But I want to make sure that the website handles user input "+" (with no whitespace) nicely. Even if "+" should be rejected, I don't want it to look like my website is broken. – yjl101
Perhaps you should show some code that concerns what you are talking about. – TLP
I tried reproducing the problem, but my test script accepted %2B in taint mode when I called param without complaint. – Quentin
@user1970978 – I put %2B in the URL. It is what you get when you submit a form with a field containing a +. – Quentin

1 Answers

2
votes

If you create a CGI object, use it.

my $cgi = CGI->new();
my $page = $cgi->param("page");

or

param("page");

but don't mix and match.