#!/usr/bin/perl -Tw
# --- Fixing the taint error message :
# --- (1) Set the PATH (you should do this for all taint mode scripts)
$ENV{PATH} = "/bin:/usr/bin";
use CGI;
use CGI::Carp qw(fatalsToBrowser);
my $cgi = new CGI;
print $cgi->header;
my $message = $cgi->param('message');
my $figlet;
# Do not try to pull out "bad" characters, like ";".
# Instead, only allow the minimal needed set of "good" characters.
if ($message =~ /[^a-zA-Z0-9 ]/) {
$figlet =
"OOPS
" .
"Your message contains illegal characters
" .
"Please use only letters and numbers without puncuation.";
}
elsif ($message) {
# --- (2) Untaint the user input with a regular expression match.
$message =~ m/^(.*)$/;
my $clean = $1;
# --- (3) Use "chdir" rather than `cd` .
chdir "figlet/figlet22";
$figlet = "" . `./figlet $clean` ."
\n";
}
print <<"END_HTML";
cgi figlet one
cgi figlet taint 2
Trying to fix the taint error messages...
END_HTML