You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Heiko Weber <he...@wecos.de> on 2006/07/07 12:06:12 UTC
Apache mod_perl Insecure dependency RegistryCooker.pm
Hello !
From time to time I got the following messages in the logfile of Apache
2.0.58. (OS is FreeBSD 6.1, mod_perl2 compiled from ports-tree).
Insecure dependency in eval while running setgid
at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm line
676
Sure, I know what "perl taint" is ... so somewhere in my own written cgi-code
I must use a taited variable. But how to find the line of code ? In the
errorlog there only the above line, no more deeper/detailed info. I didn't
find a way to detect the place where I didn't check parameter from CGI - and
there are a lot of lines ...
Any help is welcome.
Heiko
Re: Apache mod_perl Insecure dependency RegistryCooker.pm
Posted by Heiko Weber <he...@wecos.de>.
Am Donnerstag, 13. Juli 2006 22:12 schrieb Philip M. Gollucci:
> Heiko Weber wrote:
> >>> cgi-code I must use a taited variable. But how to find the line of code
> >>> ?
> >
> > thanks for the hint. I added a <Perl>-section in httpd.conf:
> > <Perl>
> > use Carp;
> > $SIG{__DIE__} = sub { confess shift };
> > $SIG{__WARN__} = \&Carp::cluck;
> > </Perl>
> >
> > at /usr/local/etc/apache2/httpd.conf line 1061
> > (unknown)('Insecure dependency in eval while running setgid at
> > /usr/loca...') called at
> > /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm line
> > 676
>
> sadly thats the eval $$eval (which is your source code)
>
> what happens if you try the script from command line under -T and run it
> setgid. That might give you a better stack trace as that takes ModPerl::*
> out of the mix.
Didn't work, the warning seems to depend on the parameter passed to it.
(I use CGI.pm). Maybe it is one of the cookies or only on "POST" form data.
I was not able to reproduce the warning in any way. I added all parameter
from access_log to the comand line ...
Maybe I will have success in saving the CGI.pm state with
$query->save(\*FILEHANDLE)
and later I can use the saved state to reproduce the warning.
Anyone know how to make a string-FILEHANDLE (like C++ strstream),
to save() into a string which could then be written into a database with
a sequence number ?
Heiko
Re: Apache mod_perl Insecure dependency RegistryCooker.pm
Posted by "Philip M. Gollucci" <pg...@p6m7g8.com>.
Heiko Weber wrote:
>>> cgi-code I must use a taited variable. But how to find the line of code ?
>
> thanks for the hint. I added a <Perl>-section in httpd.conf:
> <Perl>
> use Carp;
> $SIG{__DIE__} = sub { confess shift };
> $SIG{__WARN__} = \&Carp::cluck;
> </Perl>
>
> at /usr/local/etc/apache2/httpd.conf line 1061
> (unknown)('Insecure dependency in eval while running setgid at /usr/loca...')
> called at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm
> line 676
sadly thats the eval $$eval (which is your source code)
what happens if you try the script from command line under -T and run it setgid.
That might give you a better stack trace as that takes ModPerl::* out of the mix.
--
------------------------------------------------------------------------
Philip M. Gollucci (pgollucci@p6m7g8.com) 323.219.4708
Consultant / http://p6m7g8.net/Resume/resume.shtml
Senior Software Engineer - TicketMaster - http://ticketmaster.com
1024D/A79997FA F357 0FDD 2301 6296 690F 6A47 D55A 7172 A799 97F
"It takes a minute to have a crush on someone, an hour to like someone,
and a day to love someone, but it takes a lifetime to forget someone..."
Re: Apache mod_perl Insecure dependency RegistryCooker.pm
Posted by Heiko Weber <he...@wecos.de>.
Am Freitag, 7. Juli 2006 19:08 schrieb Philip M. Gollucci:
> Heiko Weber wrote:
> > Sure, I know what "perl taint" is ... so somewhere in my own written
> > cgi-code I must use a taited variable. But how to find the line of code ?
> > In the errorlog there only the above line, no more deeper/detailed info.
> > I didn't find a way to detect the place where I didn't check parameter
> > from CGI - and there are a lot of lines ...
>
> Try adding to a startup.pl
> use Carp;
> $SIG{__DIE__} = sub { confess shift };
> $SIG{__WARN__} = \&Carp::cluck;
Hi Philip,
thanks for the hint. I added a <Perl>-section in httpd.conf:
<Perl>
use Carp;
$SIG{__DIE__} = sub { confess shift };
$SIG{__WARN__} = \&Carp::cluck;
</Perl>
Hope, this is the same as a startup.pl
Now I got the following in errorlog:
[Thu Jul 13 17:43:09 2006] [error] [client xx.xx.xx.xx]
Insecure dependency in eval while running setgid
at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm line
676.
at /usr/local/etc/apache2/httpd.conf line 1061
(unknown)('Insecure dependency in eval while running setgid at /usr/loca...')
called at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm
line 676
ModPerl::RegistryCooker::compile('ModPerl::Registry=HASH(0xb71f2d8)', 'SCALAR(0xb68e2a8)')
called at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm
line 405
ModPerl::RegistryCooker::convert_script_to_compiled_handler('ModPerl::Registry=HASH(0xb71f2d8)')
called at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/RegistryCooker.pm
line 162
ModPerl::RegistryCooker::default_handler('ModPerl::Registry=HASH(0xb71f2d8)')
called at /usr/local/lib/perl5/site_perl/5.8.7/mach/ModPerl/Registry.pm line
30
ModPerl::Registry::handler('ModPerl::Registry', 'Apache2::RequestRec=SCALAR(0xb68dcd8)')
called at -e line 0\n\teval {...} called at -e line 0
Line 1061 is the $SIG{__DIE__} in httpd.conf.
Any idea ? Move $SIG ... into startup.pl ?
Heiko
Re: Apache mod_perl Insecure dependency RegistryCooker.pm
Posted by "Philip M. Gollucci" <pg...@p6m7g8.com>.
Heiko Weber wrote:
> Sure, I know what "perl taint" is ... so somewhere in my own written cgi-code
> I must use a taited variable. But how to find the line of code ? In the
> errorlog there only the above line, no more deeper/detailed info. I didn't
> find a way to detect the place where I didn't check parameter from CGI - and
> there are a lot of lines ...
Try adding to a startup.pl
use Carp;
$SIG{__DIE__} = sub { confess shift };
$SIG{__WARN__} = \&Carp::cluck;
--
------------------------------------------------------------------------
Philip M. Gollucci (pgollucci@p6m7g8.com) 323.219.4708
Consultant / http://p6m7g8.net/Resume/resume.shtml
Senior Software Engineer - TicketMaster - http://ticketmaster.com
1024D/A79997FA F357 0FDD 2301 6296 690F 6A47 D55A 7172 A799 97F
"It takes a minute to have a crush on someone, an hour to like someone,
and a day to love someone, but it takes a lifetime to forget someone..."