如何在污点模式下从 Perl CGI 调用 /sbin/iptables？
当我在 Perl CGI 脚本中调用“sudo /sbin/iptables ...”时，出现错误：
Insecure dependency in system while running with -T switch at usr/lib/perl5/vendor_perl/5.8.8/IPC/Run3.pm line 403
我尝试在 $ENV{'PATH 中添加“/sbin:/etc/sysconf:/etc/init.d” '}但仍然没有成功。有人有什么想法吗？
When I invoke "sudo /sbin/iptables ..." in my Perl CGI scripts, I get the error:
Insecure dependency in system while running with -T switch at usr/lib/perl5/vendor_perl/5.8.8/IPC/Run3.pm line 403
I tried to add "/sbin:/etc/sysconf:/etc/init.d" in $ENV{'PATH'} but still no success. Anybody has any idea?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您应该限制路径，意思是：将其设置为满足某些要求的少量已知值（例如 $ENV{PATH} = '/sbin:/usr/sbin:/usr/bin'; ），而不是添加到其中。请参阅
perlsec中的清理路径 了解详细信息。在您的简单情况下，最好完全清除它并仅依赖于具有完全限定文件名的系统调用。
You are supposed to restrict the path, meaning: setting it to a small number of known values that fulfill certain requirements (such as
$ENV{PATH} = '/sbin:/usr/sbin:/usr/bin';), not adding to it. See Cleaning Up Your Path inperlsecfor the details.In your simple case, it is best to clear it altogether and rely only on system calls with fully qualified file names.
是的，使用 -T 开关运行时，系统中存在不安全的依赖关系。 :p
您正在 taintperl 模式下运行脚本，并使用基于从用户传入的信息（可能被污染）的数据来调用外部程序（使用 sudo，不少于）。如果您确实确定输出有效并且不会带来风险，则需要对其进行净化：请参阅有关 清洗受污染数据。
在运行外部程序或从 CGI 执行系统操作时，您需要非常小心 - 例如，考虑如果您输入
`rm -rf /`时可能会发生什么用户输入。 perldoc perlsec 上有很多信息可以帮助您入门，但是已经写了几本书关于安全编写代码也是如此。Yes, you have an insecure dependency in system while running with the -T switch. :p
You're running your script in taintperl mode, and calling an external program (with sudo, no less) with data based on information passed in from the user (which could be tainted). If you're really sure that output is valid and doesn't pose risk, you need to untaint it: see the official documentation about laundering tainted data.
You need to be really careful when running external programs or performing system operations from a CGI -- for example, consider what might happen if you enter
`rm -rf /`as user input. There's lots of information at perldoc perlsec to get you started, but several books have been written about writing secure code as well.