CGI->params() should be tainted, right?

[jalex <ja...@sensiblenonsense.com>]

I'm running mod_perl 2.0.2 under apache 2.0.54. After adding "PerlSwitches
-wT" to my apache config, I wanted to test that I had taint mode was indeed
working, so I wrote a test script that purposely misused a CGI parameter,
expecting the taint exception to be thrown. I was surprised to find it was
not, so I wrote this small test case:

#!/usr/bin/perl -T

use strict;
use warnings;

use CGI;

delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};

print "Content-type: text/plain\n\n";
my $q = new CGI;
my $junk = $q->param('log');
# eval($q->param('log'));
if (is_tainted($junk)){
  print "Param tainted as expected\n";
} else {
  print "Oops! Where's the taint?!?\n";
}
print "\n";
print "\$^TAINT=${^TAINT}", "\n";

sub is_tainted {
  my $arg = shift;
  my $nada = substr($arg, 0, 0);
  local $@;
  eval { eval "# $nada" };
  return length($@) !=0;
}

This prints:

Oops! Where's the taint?!?

$^TAINT=1

under mod_perl2. Indeed, if I go ahead and eval $junk, as long as its valid
perl, mod_perl2 gamely evaluates it. If I instead test, for example,
environment variables, the taint exception does get thrown. Under mod_cgi,
the same script prints "Param tainted as expected". Is there a subtlety that
I'm missing here, or have I uncovered a pretty serious bug?

-- 
View this message in context: http://www.nabble.com/CGI-%3Eparams%28%29-should-be-tainted%2C-right--tf4858333.html#a13902824
Sent from the mod_perl - General mailing list archive at Nabble.com.

Re: CGI->params() should be tainted, right?

[Perrin Harkins <pe...@elem.com>]

On Dec 1, 2007 12:40 AM, Scott Gifford <sg...@suspectclass.com> wrote:
> Do any of the mod_perl developers have a comment on this?  I'm
> surprised it's not generating more feedback.

Scott,

It certainly is a bug and no one denies it.  So far, no one has had
the combination of free time and knowledge to fix it.  People who
would like to help and have time to contribute code are welcome on the
dev list.

One reason why this doesn't seem as urgent as it could be is that most
people using a relatively advanced feature like taint mode are also
using Apache2::Request, which taints things correctly.

- Perrin

Re: CGI->params() should be tainted, right?

[Scott Gifford <sg...@suspectclass.com>]

jalex <ja...@sensiblenonsense.com> writes:

[...]

> Yes, I am aware various workarounds exist, however I don't think whether
> this is a bug or not is really at all arguable: anything that is marked as
> tainted in perl needs to be also marked tainted in mod_perl2. There is
> nothing in the mod_perl documentation to suggest otherwise; in fact, there
> are lots of tutorials out there that suggest that it is very important to
> turn taint mode on exactly to catch unsafe handling of CGI parameters. I'm
> left wondering what else isn't getting marked tainted that should be.

I agree, this is a very serious bug.  Taint checking is one of Perl's
most important security features, and Web applications are one of the
areas most in need of security.  Having taint checking not working
properly for mod_perl means that users are missing out on the huge
safety net Perl provides to stop programmers from accidentally doing
unsafe things, and worse they may be relying on that functionality to
protect them, leaving their apps unexpectedly vulnerable.

Do any of the mod_perl developers have a comment on this?  I'm
surprised it's not generating more feedback.

----Scott.

Re: CGI->params() should be tainted, right?

[jalex <ja...@sensiblenonsense.com>]

Joe Schaefer wrote:
> 
> "Kevin Spencer" <ke...@gmail.com> writes:
> 
> [...]
> 
>> Using the URL:
>>
>> http://myserverhere/cgi-bin/taint-test/taint.pl?log=foo
>>
>> Produces:
>>
>> Oops! Where's the taint?!?
>>
>> $^TAINT=1
> 
> CGI.pm uses $r->args to get at the query string,
> which isn't marked as tainted by mod_perl2.  Arguably
> it's a bug in mod_perl, but you could use APR::Request
> instead, which marks all params tainted.
> 

Yes, I am aware various workarounds exist, however I don't think whether
this is a bug or not is really at all arguable: anything that is marked as
tainted in perl needs to be also marked tainted in mod_perl2. There is
nothing in the mod_perl documentation to suggest otherwise; in fact, there
are lots of tutorials out there that suggest that it is very important to
turn taint mode on exactly to catch unsafe handling of CGI parameters. I'm
left wondering what else isn't getting marked tainted that should be.

-- 
View this message in context: http://www.nabble.com/CGI-%3Eparams%28%29-should-be-tainted%2C-right--tf4858333.html#a14073958
Sent from the mod_perl - General mailing list archive at Nabble.com.

Re: CGI->params() should be tainted, right?

[Joe Schaefer <jo...@sunstarsys.com>]

"Kevin Spencer" <ke...@gmail.com> writes:

[...]

> Using the URL:
>
> http://myserverhere/cgi-bin/taint-test/taint.pl?log=foo
>
> Produces:
>
> Oops! Where's the taint?!?
>
> $^TAINT=1

CGI.pm uses $r->args to get at the query string,
which isn't marked as tainted by mod_perl2.  Arguably
it's a bug in mod_perl, but you could use APR::Request
instead, which marks all params tainted.

-- 
Joe Schaefer

Re: CGI->params() should be tainted, right?

[Kevin Spencer <ke...@gmail.com>]

On Nov 26, 2007 4:45 PM, jalex <ja...@sensiblenonsense.com> wrote:
>
>
> Scott Gifford wrote:
> >
> >
> > FYI, this test case works properly under my installation of Debian
> > mod_perl 1.29.0.2 under apache 1.3.34.
> >
> > Jalex, you might want to print out the value of your test variable and
> > make sure it is being received properly.  I thought I saw the same
> > problem, until I realized that I hadn't set the log parameter to
> > anything, and undefined CGI parameters are not tainted.
> >
> > Is anybody else seeing this behavior under mod_perl 2?  It would
> > indeed be a very serious bug.
> >
> > ----Scott.
> >
> >
>
> Yes, I did try printing it out. In fact, I tried calling eval() on it, and
> no exception was thrown! If I tried calling eval on an expression derived
> from an environment variable, then the taint exception does get thrown as
> expected. It's just the return values of CGI's param() method that seem to
> have somehow become untainted. If I run same test scripts under mod_cgi
> rather than mod_perl2, the taint exceptions get thrown exactly where I
> expect to see them.

I can reproduce this behavior with mod_perl 2.0.3, Perl 5.8.8 on
Solaris 9.  Using ModPerl::RegistryPrefork at least.  From my
httpd.conf:

PerlSwitches -T

<Location /cgi-bin/taint-test/>
   SetHandler perl-script
   PerlResponseHandler ModPerl::RegistryPrefork
   PerlOptions +ParseHeaders
   Options +ExecCGI
</Location>

shell>cd /usr/local/apache2/cgi-bin/taint-test
shell>cat taint.pl
#!/usr/bin/perl

use strict;
use warnings;

use CGI;

delete @ENV{qw(IFS CDPATH ENV BASH_ENV)};

print "Content-type: text/plain\n\n";
my $q = new CGI;
my $junk = $q->param('log');
# eval($q->param('log'));
if (is_tainted($junk)){
 print "Param tainted as expected\n";
} else {
 print "Oops! Where's the taint?!?\n";
}
print "\n";
print "\$^TAINT=${^TAINT}", "\n";

sub is_tainted {
 my $arg = shift;
 my $nada = substr($arg, 0, 0);
 local $@;
 eval { eval "# $nada" };
 return length($@) !=0;
}

Using the URL:

http://myserverhere/cgi-bin/taint-test/taint.pl?log=foo

Produces:

Oops! Where's the taint?!?

$^TAINT=1

Removing the <Location> directive and adding -T to the shebang line to
run under mod_cgi (same URL) produces:

Param tainted as expected

$^TAINT=1

--
Kevin.

Re: CGI->params() should be tainted, right?

[jalex <ja...@sensiblenonsense.com>]

Scott Gifford wrote:
> 
> 
> FYI, this test case works properly under my installation of Debian
> mod_perl 1.29.0.2 under apache 1.3.34.
> 
> Jalex, you might want to print out the value of your test variable and
> make sure it is being received properly.  I thought I saw the same
> problem, until I realized that I hadn't set the log parameter to
> anything, and undefined CGI parameters are not tainted.
> 
> Is anybody else seeing this behavior under mod_perl 2?  It would
> indeed be a very serious bug.
> 
> ----Scott.
> 
> 

Yes, I did try printing it out. In fact, I tried calling eval() on it, and
no exception was thrown! If I tried calling eval on an expression derived
from an environment variable, then the taint exception does get thrown as
expected. It's just the return values of CGI's param() method that seem to
have somehow become untainted. If I run same test scripts under mod_cgi
rather than mod_perl2, the taint exceptions get thrown exactly where I
expect to see them.


-- 
View this message in context: http://www.nabble.com/CGI-%3Eparams%28%29-should-be-tainted%2C-right--tf4858333.html#a13961667
Sent from the mod_perl - General mailing list archive at Nabble.com.

Re: CGI->params() should be tainted, right?

[Scott Gifford <sg...@suspectclass.com>]

jalex <ja...@sensiblenonsense.com> writes:

> I'm running mod_perl 2.0.2 under apache 2.0.54. After adding "PerlSwitches
> -wT" to my apache config, I wanted to test that I had taint mode was indeed
> working, so I wrote a test script that purposely misused a CGI parameter,
> expecting the taint exception to be thrown. I was surprised to find it was
> not, so I wrote this small test case:

FYI, this test case works properly under my installation of Debian
mod_perl 1.29.0.2 under apache 1.3.34.

Jalex, you might want to print out the value of your test variable and
make sure it is being received properly.  I thought I saw the same
problem, until I realized that I hadn't set the log parameter to
anything, and undefined CGI parameters are not tainted.

Is anybody else seeing this behavior under mod_perl 2?  It would
indeed be a very serious bug.

----Scott.

Re: CGI->params() should be tainted, right?

[jalex <ja...@sensiblenonsense.com>]

Michael Peters wrote:
> 
> jalex wrote:
>> I'm running mod_perl 2.0.2 under apache 2.0.54. After adding
>> "PerlSwitches
>> -wT" to my apache config, I wanted to test that I had taint mode was
>> indeed
>> working, so I wrote a test script that purposely misused a CGI parameter,
>> expecting the taint exception to be thrown. I was surprised to find it
>> was
>> not, so I wrote this small test case:
>> 
>> #!/usr/bin/perl -T
> 
> Taint is not controlled by the shebang line on the script because taint it
> interpreter wide and must be turned on when the interpreter starts, IE
> when
> Apache starts.
> 
> Try adding
> 
>   PerlSwitches -T
> 
> to your httpd.conf
> 

Note that the section you quoted says that I did exactly that. The -T is
also on the shebang line so that the same script will have taint enabled
when run from mod_cgi.

Also note that later in my post, I state that unsafe references to
environment variables trigger that taint exception as expected, so taint
mode does appear to be working in my mod_perl2 environment. CGI parameters,
however, when obtained through the CGI.pm param() method, are unexpectededly
not tainted.
-- 
View this message in context: http://www.nabble.com/CGI-%3Eparams%28%29-should-be-tainted%2C-right--tf4858333.html#a13913188
Sent from the mod_perl - General mailing list archive at Nabble.com.

Re: CGI->params() should be tainted, right?

[Michael Peters <mp...@plusthree.com>]

jalex wrote:
> I'm running mod_perl 2.0.2 under apache 2.0.54. After adding "PerlSwitches
> -wT" to my apache config, I wanted to test that I had taint mode was indeed
> working, so I wrote a test script that purposely misused a CGI parameter,
> expecting the taint exception to be thrown. I was surprised to find it was
> not, so I wrote this small test case:
> 
> #!/usr/bin/perl -T

Taint is not controlled by the shebang line on the script because taint it
interpreter wide and must be turned on when the interpreter starts, IE when
Apache starts.

Try adding

  PerlSwitches -T

to your httpd.conf

-- 
Michael Peters
Developer
Plus Three, LP