提问人:Ahmed Dildar 提问时间:9/14/2023 更新时间:9/15/2023 访问量:107
在列表上下文中调用的 CGI::p aram 和 Undefined 子例程 &CGI::P lus::randword 调用错误
CGI::param called in list context and Undefined subroutine &CGI::Plus::randword called errors
问:
我正在尝试对 perl 中的 Web 应用程序进行 dockerize,最后它通过 Apache 与 MariaDB 连接。 我已经设置了数据库。我的容器正在运行,但问题出在perl脚本上;他们没有运行。此外,一个名为CGI PLUS的模块在安装时出现问题。有人可以查看以下文本,让我知道这里可能存在的问题是什么,并分享纠正它的解决方案吗?
################################################################
#Perl modules
Install the required Perl modules.
cpan CGI
cpan CGI::Plus
cpan CGI::Session
cpan DBI
cpan Crypt::Eksblowfish::Bcrypt
cpan File::Basename
cpan Auth::Yubikey_WebClient
cpan Tie::IxHash
cpan Apache::Solr
cpan HTML::Entities
cpan WWW::CSRF
cpan Crypt::Random
cpan LWP::Simple
cpan Text::NSP::Measures::2D::Fisher::twotailed
cpan XML::Simple
cpan Statistics::R
cpan Cache::FileCache
cpan Digest::MD5
cpan Date::Calc
cpan Data::Dumper
cpan Text::ParseWords
cpan Cwd
cpan Log::Log4perl
#Tests of the module XML:DOM::XPath fail because they use a deprecated syntax but the module is OK
# Install with the following command
perl -MCPAN -e "CPAN::Shell->notest('install', 'XML::DOM::XPath')";
cpan Bio::DB::Fasta
cpan Log::Dispatch::File
################################################################
# Apache
Set up an Apache server with ssl enabled.
Enable the following modules
enable session
session_cookie
rewrite
RewriteEngine
ssl
Generate a dummy certificate only for a test server.
Call the script /usr/bin/gensslcert.
Add the following lines to vhost-ssl.conf
Header always set X-Content-Type-Options "nosniff"
Header always set X-Xss-Protection "1; mode=block"
Header always set X-Frame-Options "SAMEORIGIN"
Header set Content-Security-Policy "default-src https: 'unsafe-eval' 'u
以下是尝试安装 CGI PLUS 后生成的错误日志。
5.066 CGI::param called in list context from t/test.t line 96, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/local/lib/perl5/site_perl/5.38.0/CGI.pm line 415.
5.066 Undefined subroutine &CGI::Plus::randword called at /root/.cpan/build/CGI-Plus-0.15-0/blib/lib/CGI/Plus.pm line 644.
5.066 # Looks like your test exited with 255 just after 4. 5.068 t/test.t ..
5.068 Dubious, test returned 255 (wstat 65280, 0xff00) 5.068 Failed
33/37 subtests
如果您需要任何进一步的信息来了解完整的场景,也请告诉我。以下是我的 docker 文件,显示我如何尝试运行 perl 脚本。你能在其中找到任何问题或问题吗?
# Use the latest Perl image as the base
FROM perl:latest
# Install system dependencies
RUN apt-get update && apt-get install -y \
apache2 \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
#Install the required Perl modules
RUN cpan CGI
RUN cpan App::cpanminus
RUN cpan CPAN::DistnameInfo
#Install libcgi-pm-perl using apt-get
RUN apt-get update && apt-get install -y libcgi-pm-perl
#Install the required Perl modules
RUN cpan CGI::Safe
RUN cpan String::Util
#RUN cpan CGI::Plus
RUN cpan -T CGI::Plus
RUN cpan CGI::Session
RUN cpan DBI
RUN cpan Crypt::Eksblowfish::Bcrypt
RUN cpan File::Basename
RUN cpan Auth::Yubikey_WebClient
RUN cpan Tie::IxHash
RUN cpan Apache::Solr
RUN cpan HTML::Entities
RUN cpan WWW::CSRF
RUN cpan Crypt::Random
RUN cpan LWP::Simple
RUN cpan Text::NSP::Measures::2D::Fisher::twotailed
RUN cpan XML::Simple
RUN apt-get update && apt-get install -y r-base
RUN cpan Statistics::R
RUN cpan Cache::FileCache
RUN cpan Digest::MD5
RUN cpan Date::Calc
RUN cpan Data::Dumper
RUN cpan Text::ParseWords
RUN cpan Cwd
RUN cpan Log::Log4perl
# Install XML::DOM::XPath without testing
RUN perl -MCPAN -e "CPAN::Shell->notest('install', 'XML::DOM::XPath')"
# Install Bio::DB::Fasta
RUN cpan Bio::DB::Fasta
#Install Log::Dispatch::File
RUN cpan Log::Dispatch::File
# Copy your Perl web application files to the Apache document root
COPY ./cgi-bin /var/www/html/cgi-bin
COPY ./css_js /var/www/html/css_js
#COPY ./cgi-bin /srv/www/cgi-bin/mysql/.
#COPY ./srv/www/htdocs/cal /srv/www/htdocs/cal
#COPY ./srv/www/htdocs/DataTables-1.10.22/ srv/www/htdocs/DataTables-1.10.22
#COPY ./cal/img /srv/www/htdocs/gif
# Copy your custom virtual host configuration into the container
#COPY custom-vhost.conf /etc/apache2/sites-available/
# Set permissions for Apache user (www-data) to access the application files
#RUN chown -R www-data:www-data /var/www/html/
#Enable your custom virtual host:
#RUN a2ensite custom-vhost
# Enable CGI execution and set the handler for .cgi and .pl files
RUN sed -i 's/Options Indexes FollowSymLinks/Options Indexes FollowSymLinks ExecCGI/' /etc/apache2/apache2.conf
RUN echo 'AddHandler cgi-script .cgi .pl' >> /etc/apache2/apache2.conf
#Enable perl files
#RUN a2enmod cgid
# Set the executable permission on Perl scripts
#RUN chmod +x /var/www/html/cgi-bin/*.pl
# Set the executable permission on Perl scripts in the cgi-bin directory and its subdirectories
RUN find /var/www/html/cgi-bin -type f -name "*.pl" -exec chmod +x {} \;
# Expose port 80 for Apache
EXPOSE 80
# Start Apache web server
CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"]
# Make all .pl files executable in the cgi-bin directory and its subdirectories
#RUN find /srv/www/cgi-bin/mysql/. -type f -name "*.pl" -exec chmod +x {} \;
当我运行 .pl 脚本时,它给出了如下内容:
# perl admin.pl
Status: 500
Content-type: text/html
<h1>Software error:</h1>
<pre>Undefined subroutine &CGI::Plus::randword called at
/usr/local/lib/perl5/site_perl/5.38.0/CGI/Plus.pm line 644.
</pre>
<p>
For help, please send mail to this site's webmaster, giving this error message
and the time and date of the error.
</p>
[Wed Sep 13 16:14:24 2023] admin.pl: Undefined subroutine
&CGI::Plus::randword called at
/usr/local/lib/perl5/site_perl/5.38.0/CGI/Plus.pm line 644.
答:
查看源代码,您可以看到它确实尝试使用它没有定义自己的子。randword
向上滚动到顶部,这是一个潜艇,其名称听起来像是可能期望提供的东西。use String::Util ':all';
该模块的源代码中没有迹象,因此让我们看一下更新日志:randword
1.33 2023-01-31
- 删除一堆旧的已弃用函数:crunch、cellfill、define、randword、fullchomp、randcrypt、equndef、neundef
回到 CGI::P lus,看看它的安装程序:
'String::Util' => '1.24'
所以它声明它需要 String::Util 1.24 或更高版本,但这是错误的,因为它需要一个小于 1.33 的版本。
您可以:
- 在本地将 CGI::P lus 修补到:
- 更正 Build.PL 中的错误或
- 将调用替换为其他内容
randword
- 向作者提交错误报告并要求他们修复它(尽管我不会抱太大希望,因为该模块已经近十年没有更新了,而且这个错误已经存在了半年多)......哦,等等,有人在 7 个月前这样做了,但被忽略了
- 用其他东西替换 CGI::P lus(考虑到缺乏持续的支持,这可能是一个明智的选择(看起来作者自 2016 年以来一直在 CPAN 上不活跃))。
评论
use strict;
BEGIN {require './Snv.pm';}
use WWW::CSRF qw(generate_csrf_token check_csrf_token CSRF_OK);
my $cgi = new CGI::Plus;
$cgi->csrf(1);
my $ref = $cgi->Vars;
my $snv = new Snv;
my %options = ('MaxAge' => 10800); #for WWW::CSRF 3 hours, same as session cookie
#$ref = $snv->htmlencodehash($ref);
my ($dbh) = "";
my $item = "";
my $value = "";
my %logins = ();
open(IN, "/srv/tools/textreadonly.txt");
while (<IN>){chomp;($item,$value)=split(/\:/);$logins{$item}=$value;}
close IN;
CGI::p aram 在列表上下文中调用
阅读您正在使用的任何模块的文档始终是一个好主意。CGI 的文档包括一个标题为“获取单个命名参数的一个或多个值”的部分,其中包含以下内容:
警告 - 如果不清理用户输入,在列表上下文中调用 param() 可能会导致漏洞,因为可能会将其他参数键和值注入到代码中。这就是 multi_param() 方法存在的原因,为了明确返回列表,请注意 param() 仍然可以在列表上下文中调用,并将返回一个列表以实现反向兼容性。
以下代码是一个漏洞示例,因为对 param 的调用将在列表上下文中进行评估,因此可能会将额外的键和值注入哈希中:
my %user_info = ( id => 1, name => $q->param('name'), );
上述问题的解决方法是在调用 ->param 时强制标量上下文,方法是在前面加上“标量”
name => scalar $q->param('name'),
如果在列表上下文中使用参数调用 param(),则会引发警告 通过 CGI.pm,您可以通过将 $CGI::LIST_CONTEXT_WARN 设置为 0 或改用 multi_param() 方法来禁用此警告
如果查询字符串中未给出值,如查询“name1=&name2=”,则该值将作为空字符串返回。
如果参数根本不存在,则 param() 将在标量上下文中返回 undef,在列表上下文中返回空列表。
评论