Securing a UNIX Perl script 1

[duncdude]

Can anyone tell me if it is possible to secure a script so that anyone trying to open it will simply see jibberish - i.e. would it be possible to wrap a script up using something like Platypus

I would like to do this with a CGI script in particular

Many thanks
Duncan

 

[MikeLacey]

perlfilter does what you want, not easily though.

Documentation on my system is at file://C:\Perl\html\lib\Pod\perlfilter.html

Mike

You cannot really appreciate Dilbert unless you've read it in the
original Klingon.

Want great answers to your Tek-Tips questions? Have a look at faq219-2884

 

[TrojanWarBlade]

If it's a CGI script then no-one client side can see it anyway.
The whole point of CGI is that it generates output that the client browser sees. It never gets access to the CGI source.


Trojan.

 

[duncdude]

That's fantastic! Thank you Mike - I'll give it a go & let u know how I got on

Cheers
Duncan


Kind Regards
Duncan

 

[duncdude]

Thanks for your comments Trojan - unfortunately I have no option but to put the script on their server

Duncan


Kind Regards
Duncan

 

[TrojanWarBlade]

Then why not write it in another language?
Or maybe even compile it?


Trojan.

 

[duncdude]

I have written a script that can edit QuarkXpress EPS files via a web form. It lcocates pointers within the file and alters the EPS. It then - using Ghostscript and Image::Magick - produces a proof for the client to see. Unfortunately it is now possible for them to make as many templates as they like - and utilise my script, I can't have that!!!

Regards
Duncan


Kind Regards
Duncan

 

[TrojanWarBlade]

Then either you should restrict it to a webserver under your control only, or migrate it to a different language.
It is possible to "encrypt" (and I use the term in it's loosest sense!) the source but it's usually trivial to unencrypt it.
Binaries are the obvious way forward or better still, use your own server.

Trojan.

 

[MikeLacey]

I've had some very good results with Perl2Exe.

Mike

You cannot really appreciate Dilbert unless you've read it in the
original Klingon.

Want great answers to your Tek-Tips questions? Have a look at faq219-2884

 

[duncdude]

maybe I can give the script to someone with a PC and they can Perl2Exe it for me!?


Kind Regards
Duncan

 

[MikeLacey]

That would not be legal.

Mike

You cannot really appreciate Dilbert unless you've read it in the
original Klingon.

Want great answers to your Tek-Tips questions? Have a look at faq219-2884

 

[icrf]

And futile, for if you use perl2exe to make a Windows x86 binary, it won't be useful on any other kind of system.

Better to use a simple code filter and obfuscate your code (keep the good people clean), or get more honest clients that won't try and rip you off.

________________________________________
Andrew

 

[Milleniumlegend]

You can use the PAR tool to do this.
Follow this link

http://par.perl.org/index.cgi?FAQ

This would allow you to create the executables for deployment. Alternatively you may use the Activestates IDE and it would create the executables.

To Obfuscate the code you can also use filters once you install PAR. This would render the code to become scrambled while maintaining the functionality.

pp -F Bleach will obfuscate all the code that you may have.

HTH

 

[icrf]

PAR will make an executable, but won't compile the perl code in any fashion. It just packages it up into a .zip style package.

You can use a nice obfuscating filter, but you have to undo them to run the code, so you don't gain much for someone who really wants a look (though Acme::Bleach is kind of fun). There's probably something out there like the javascript obfuscating filters that rename all your variables and remove all unneccessary whitespace. The code still works, even looks like code, but not simple, maintainable code.

________________________________________
Andrew

 

[Milleniumlegend]

Yes PAR would not compile the code. The compile may be performed using perlcc if that is needed. If you do a pp -c it will perform a dependency check. If this package is needed to be deployed we can then package it using PAR.

 

[rzs0502]

Although meant to be a 'compiler' for shell scripts, I've managed to use shc on Perl scripts as well.

http://www.datsi.fi.upm.es/~frosal/frosal.html

"If you always do what you've always done, you will always be where you've always been."