Re: opinion on shell cgi scripts

[Gaby Vanhegan <gaby@vanhegan.net>]

Greg Wooledge wrote:

>>What's the general opinion on using shell scripts as cgi scripts from
>>a security viewpoint? What are the risks invoved? Is it a no-go, or
>>is safety ok when certain criteria are met?
> 
> It's fine as long as you treat any browser-supplied parameters as
> toxic waste.  Double-quote all your variable references, sanitize
> your inputs (e.g. by stripping out all non-alphanumeric characters),
> and so on.

The reason PHP and CGI are better suited to the task is because they do 
a lot of this for you, and also provide handy tools to do it as well.

Out of interest, what's wrong with using something like:

system( "my.script.sh" );

In some Perl CGI or PHP?  Unless you give the script SUID permissions, 
it's never going to be able to run as anything other than the apache user.

Gaby

-- 
Ha! Ha! Ha!  Dislocation...
- Phil Ken Sebben

gaby@vanhegan.net
http://vanhegan.net