📄 ch08_01.htm
字号:
<?label 8. Security?><html><head><title>Security (CGI Programming with Perl)</title><link href="../style/style1.css" type="text/css" rel="stylesheet" /><meta name="DC.Creator" content="Scott Guelich, Gunther Birznieks and Shishir Gundavaram" /><meta scheme="MIME" content="text/xml" name="DC.Format" /><meta content="en-US" name="DC.Language" /><meta content="O'Reilly & Associates, Inc." name="DC.Publisher" /><meta scheme="ISBN" name="DC.Source" content="1565924193L" /><meta name="DC.Subject.Keyword" content="stuff" /><meta name="DC.Title" content="CGI Programming with Perl" /><meta content="Text.Monograph" name="DC.Type" /></head><body bgcolor="#ffffff"><img src="gifs/smbanner.gif" alt="Book Home" usemap="#banner-map" border="0" /><map name="banner-map"><area alt="CGI Programming with Perl" href="index.htm" coords="0,0,466,65" shape="rect" /><area alt="Search this book" href="jobjects/fsearch.htm" coords="467,0,514,18" shape="rect" /></map><div class="navbar"><table border="0" width="515"><tr><td width="172" valign="top" align="left"><a href="ch07_04.htm"><img src="../gifs/txtpreva.gif" alt="Previous" border="0" /></a></td><td width="171" valign="top" align="center"><a href="index.htm">CGI Programming with Perl</a></td><td width="172" valign="top" align="right"><a href="ch08_02.htm"><img src="../gifs/txtnexta.gif" alt="Next" border="0" /></a></td></tr></table></div><hr align="left" width="515" /><h1 class="chapter">Chapter 8. Security</h1><div class="htmltoc"><h4 class="tochead">Contents:</h4><p><a href="ch08_01.htm">The Importance of Web Security</a><br><a href="ch08_02.htm">Handling User Input</a><br><a href="ch08_03.htm">Encryption</a><br><a href="ch08_04.htm">Perl's Taint Mode</a><br><a href="ch08_05.htm">Data Storage</a><br><a href="ch08_06.htm">Summary</a><br></p></div><p>CGI programming <a name="INDEX-1666" /><a name="INDEX-1667" />offers yousomething amazing: as soon as your script is online, it isimmediately available to the entire world. Anyone from almostanywhere can run the application you created on your web server. Thismay make you excited, but it should also make you scared. Noteveryone using the Internet has honest intentions. Crackers<a href="#FOOTNOTE-12">[12]</a> may attempt to vandalize your web pages inorder to show off to friends. Competitors or investors may try toaccess internal information about your organization and its products.</p><blockquote><a name="FOOTNOTE-12" /><p>[12]A <em class="emphasis">cracker</em> is someone who attempts to breakinto computers, snoop network transmissions, and get into other formsof online mischief. This is quite different from a<em class="emphasis">hacker</em>, a clever programmer who can findcreative, simple solutions to problems. Many programmers (most ofwhom consider themselves hackers) draw a sharp distinction betweenthe two terms, even though the mainstream media often doesnot.</p></blockquote><p>Not all security issues involve malevolent users. The worldwideavailability of your CGI script means that someone may run yourscript under circumstances you never imagined and certainly nevertested. Your web script should not wipe out files because someonehappened to enter an apostrophe in a form field, but this ispossible, and issues like these also represent security concerns.</p><div class="sect1"><a name="ch08-47634" /><h2 class="sect1">8.1. The Importance of Web Security</h2><p>Many CGI developers do not take<a name="INDEX-1668" /> <a name="INDEX-1,669" />security as seriously asthey should. So before we look at how to make CGI scripts moresecure, let's look at why we should worry about security in thefirst place:</p><ol><li><p><em class="emphasis">On the Internet, your web site represents your publicimage.</em> If your web pages are unavailable or have beenvandalized, that affects others' impressions of yourorganization, even if the focus of your organization has nothing todo with web technology.</p></li><li><p><em class="emphasis">You may have valuable information on your webserver.</em> You may have sensitive or valuable informationavailable in a restricted area that you may wish to keep unauthorizedpeople from accessing. For example, you may have content or servicesavailable to paying members, which you would not want non-payingcustomers or non-members to access. Even files that are not part ofyour web server's document tree and are thus not availableonline to anyone (e.g., credit card numbers) could be compromised.</p></li><li><p><em class="emphasis">Someone who has cracked your web server has easier accessto the rest of your network.</em> If you have no valuableinformation on your web server, you probably cannot say that aboutyour entire network. If someone breaks into your web server, itbecomes much easier for them to break into another system on yournetwork, especially if your web server is inside yourorganization's firewall (which, for this reason, is generally abad idea).</p></li><li><p><em class="emphasis">You sacrifice potential income when your system isdown.</em> If your organization generates revenue directly fromyour web site, you certainly lose income when your system isunavailable. However, even if you do not fall into this group, youlikely offer marketing literature or contact information online.Potential customers who are unable to access this information maylook elsewhere when making their decision.</p></li><li><p><em class="emphasis">You waste time and resources fixing problems.</em>You must perform many tasks when your systems are compromised. First,you must determine the extent of the damage. Then you probably needto restore from backups. You must also determine what went wrong. Ifa cracker gained access to your web server, then you must determinehow the cracker managed this in order to prevent future break-ins. Ifa CGI script damaged files, then you must locate and fix the bug toprevent future problems.</p></li><li><p><em class="emphasis">You expose yourself to liability.</em> If you developCGI scripts for other companies, and one of those CGI scripts isresponsible for a large security problem, then you may understandablybe liable. However, even if it is your company for whom you'redeveloping CGI scripts, you may be liable to other parties. Forexample, if someone cracks your web server, they could use it as abase to stage attacks on other companies. Likewise, if your companystores information that others consider sensitive (e.g., yourcustomers' credit card numbers), you may be liable to them ifthat information is leaked.</p></li></ol><p>These are only some of the many reasons why web security is soimportant. You may be able to come up with other reasons yourself. Sonow that you recognize the importance of creating secure CGI scripts,you may be wondering what makes a CGI script secure. It can be summedup in one simple maxim: <em class="emphasis">never trust any data coming fromthe user.</em> This sounds quite simple, but in practiceit's not. In the remainder of this chapter, we'll explorehow to do this.</p></div><hr align="left" width="515" /><div class="navbar"><table border="0" width="515"><tr><td width="172" valign="top" align="left"><a href="ch07_04.htm"><img src="../gifs/txtpreva.gif" alt="Previous" border="0" /></a></td><td width="171" valign="top" align="center"><a href="index.htm"><img src="../gifs/txthome.gif" alt="Home" border="0" /></a></td><td width="172" valign="top" align="right"><a href="ch08_02.htm"><img src="../gifs/txtnexta.gif" alt="Next" border="0" /></a></td></tr><tr><td width="172" valign="top" align="left">7.4. Bookmarklets</td><td width="171" valign="top" align="center"><a href="index/index.htm"><img src="../gifs/index.gif" alt="Book Index" border="0" /></a></td><td width="172" valign="top" align="right">8.2. Handling User Input</td></tr></table></div><hr align="left" width="515" /><img src="../gifs/navbar.gif" alt="Library Navigation Links" usemap="#library-map" border="0" /><p><font size="-1"><a href="copyrght.htm">Copyright © 2001</a> O'Reilly & Associates. All rights reserved.</font></p><map name="library-map"><area href="../index.htm" coords="1,1,83,102" shape="rect" /><area href="../lnut/index.htm" coords="81,0,152,95" shape="rect" /><area href="../run/index.htm" coords="172,2,252,105" shape="rect" /><area href="../apache/index.htm" coords="238,2,334,95" shape="rect" /><area href="../sql/index.htm" coords="336,0,412,104" shape="rect" /><area href="../dbi/index.htm" coords="415,0,507,101" shape="rect" /><area href="../cgi/index.htm" coords="511,0,601,99" shape="rect" /></map></body></html>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -