Scalers within the open() command?

[ScoobyDood]

I'm trying to make a script that allows users to create a new page in my directory. When I test it is says something like 'Insecure dependency on open()'. I might have to chmod it, but I using Windows98 for most of my work (Although I do have a computer with Linux) Here is the script: (In part)

#Start script

$name=$cgiobject->param("name&quot

#Some other Scalers...

open (NEW ">$name.html&quot || die "!$";

#Print some stuff...
#End script

What's the problem? Computers - Can't live with 'em, can't live without 'em! Check this out:

http://www.neopets.com/refer.phtml?username=scooby_dood

 

[Krel]

You probably have taint mode on. Either remove the -T from the command line, or use a regular expression on the data to make sure it's not an invalid file name.

 

[sleipnir214]

My perl interpreter on both Linux and Win32 complains about the missing comma in your open statement.

open (NEW, ">$name.html&quot or die "!$";
______________________________________________________________________
Perfection in engineering does not happen when there is nothing more to add.
Rather it happens when there is nothing more to take away.

 

[ScoobyDood]

Oh, I have the comma. Sorry, that was just a typo. Krel, I am using Windows98, so I don't think I have a command line, do I? Computers - Can't live with 'em, can't live without 'em! Check this out:

http://www.neopets.com/refer.phtml?username=scooby_dood

 

[Krel]

You do have a command line - it's the MS-DOS prompt.

But actually, I meant the shebang line. You probably have something like

#!/Perl/bin/Perl

- that's what mine looks like anyway. Does yours look something like this?

#!/Perl/bin/Perl -T

If so, it means that you have to untaint any variables supplied by the user that are going to be used for potentially dangerous operations - like creating/overwriting a file. Remove the -T and it should work. Alternatively, if you want taint mode on, then you have to make a regular expression that makes sure it's a valid filename. Here's an example that will untaint ANYTHING, regardless of whether it is acceptable data or not. I don't recommend you use this, but it'll give you an example.

sub untaint {
  my $tainted = shift;
  $tainted =~ /([.\n]+)/;
  return $1;
}

my $untainted = untaint($tainted);
open FILE,">$untainted.html";

Replace that all-encompassing regexp with one that fits your data.