regex-verfier cgi - dont want to use system or backticks

[TechCrazy]

I am writing a cgi script which will accept a regex(perl syntax) and a
string and it has to determine if the regex can generate the string.
This is what I came up with but it uses a system() on tainted data and
is not very safe against quotes. How do I get around this. Thanks a
lot, gurus.

my $text_to_be_matched = $cgi->param("text_to_be_matched") ;
my $regex = $cgi->param("regex") ;
my $cmd = "/opt/third-party/bin/perl -e \"
if (\'$text_to_be_matched\' =~ m/$regex/) {
print \'$text_to_be_matched matches $regex\' ;
}
else {
print \'$text_to_be_matched does not match
$regex\' ;
}
\"
";

print $cmd ;
system($cmd);

 

[Fabian Pilkowski]

I am writing a cgi script which will accept a regex(perl syntax) and a
string and it has to determine if the regex can generate the string.
This is what I came up with but it uses a system() on tainted data and
is not very safe against quotes. How do I get around this. Thanks a
lot, gurus.

my $text_to_be_matched = $cgi->param("text_to_be_matched") ;
my $regex = $cgi->param("regex") ;
my $cmd = "/opt/third-party/bin/perl -e \"
if (\'$text_to_be_matched\' =~ m/$regex/) {
print \'$text_to_be_matched matches $regex\' ;
}
else {
print \'$text_to_be_matched does not match $regex\' ;
}
\"
";
print $cmd ;
system($cmd);

You want do this without system()? Nothing more simply than that. Just
omit the system() ... ;-)

my $text_to_be_matched = $cgi->param("text_to_be_matched") ;
my $regex = $cgi->param("regex") ;
if ( $text_to_be_matched =~ m/$regex/ ) {
print "$text_to_be_matched matches $regex";
}
else {
print "$text_to_be_matched does not match $regex";
}

Is that what you want?

But be aware, it is also possible to call your script with an evil
$regex, e.g. by using the (?{...}) construct. Sure, you could call
quotemeta() first, but then its more like a string than a pattern.

Perhaps anyone else has a good idea to avoid evil patterns -- but I
think it's not as easy as it seems.

regards,
fabian

 

[TechCrazy]

sorry about the stupid question

thanks a lot, Fabian

 

[Brian McCauley]

my $text_to_be_matched = $cgi->param("text_to_be_matched") ;
my $regex = $cgi->param("regex") ;
if ( $text_to_be_matched =~ m/$regex/ ) {
print "$text_to_be_matched matches $regex";
}
else {
print "$text_to_be_matched does not match $regex";
}

Is that what you want?

But be aware, it is also possible to call your script with an evil
$regex, e.g. by using the (?{...}) construct.

Be aware that this is untrue.

The compilation of the (?{...}) construct is disabled by default in
regexes that include interpolated variables.

To use (?{...}) in an interpolated regex you need to "use re 'eval'" or
precomple the (?{...}) components using qr// then interpolate them.

 

[Fabian Pilkowski]

Be aware that this is untrue.

The compilation of the (?{...}) construct is disabled by default in
regexes that include interpolated variables.

To use (?{...}) in an interpolated regex you need to "use re 'eval'" or
precomple the (?{...}) components using qr// then interpolate them.

I'd read this in perldoc at sometime (and also discussed this in some
other threads a long time ago) but didn't thought about this here.

thanks for your correction,
fabian