From owner-ports-jp@jp.FreeBSD.org Fri Oct  3 03:59:58 2003
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) id h92Ixw974571;
	Fri, 3 Oct 2003 03:59:58 +0900 (JST)
	(envelope-from owner-ports-jp@jp.FreeBSD.org)
Received: from t-mta7.odn.ne.jp (mfep7.odn.ne.jp [143.90.131.185])
	by castle.jp.FreeBSD.org (8.11.6p2+3.4W/8.11.3) with ESMTP/inet id h92IxwJ74566
	for <ports-jp@jp.FreeBSD.org>; Fri, 3 Oct 2003 03:59:58 +0900 (JST)
	(envelope-from shige@FreeBSD.org)
Received: from athena.emerald.instat.ne.jp ([211.121.221.199])
          by t-mta7.odn.ne.jp with ESMTP
          id <20031002185957491.SSSD.458556.t-mta7.odn.ne.jp@mta7.odn.ne.jp>;
          Fri, 3 Oct 2003 03:59:57 +0900
Message-Id: <20031003.040919.115003540.shige@FreeBSD.org>
To: ports-jp@jp.FreeBSD.org, delmonta@ht.sakura.ne.jp
From: Shigeyuki Fukushima <shige@freebsd.org>
In-Reply-To: <3F7AEF91.1F50BF95@ht.sakura.ne.jp>
References: <20031001.230524.48741907.shige@FreeBSD.org>
	<3F7AEA59.BCAED182@ht.sakura.ne.jp>
	<3F7AEF91.1F50BF95@ht.sakura.ne.jp>
X-Prom-Mew: Prom-Mew 2.20NG (procmail reader for Mew)
X-Mailer: Mew version 2.2 on Emacs 21.3 / Mule 5.0 (SAKAKI)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: ports-jp@jp.FreeBSD.org
Precedence: list
Date: Fri, 03 Oct 2003 04:09:19 +0900
X-Sequence: ports-jp 14200
Subject: [ports-jp 14200] Re: freebsd PRs related japanese/perl5
Sender: owner-ports-jp@jp.FreeBSD.org
X-Originator: shige@FreeBSD.org
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+030902

From: IIJIMA Hiromitsu <delmonta@ht.sakura.ne.jp>
Subject: [ports-jp 14195] Re: freebsd PRs related japanese/perl5
Date: Thu, 02 Oct 2003 00:15:29 +0900

$BJ!Eg$G$9!#(B

> > $B!t(BHow-to-repeat $B$N$H$3$m$N(B exploit code $B$,$=$N$^$^$G$OF0$+$J$$$N$G!"(B
> > $B!t$3$l$b$-$A$s$HF0$/$b$N$rMQ0U$7$^$9!#(B
> 
> $B%3!<%I$rFI$s$G$$$^$9$,!"$b$7$+$7$?$i(B perl 5.005_03 $B$O1F6A$J$$$+$b!"$H(B
> $B;W$($F$-$^$7$?!#(BPR $B$K(B followup $B$rF~$l$^$9!#(B

exploit code $B$,L@<($5$l$F$J$+$C$?$N$G$9$,!"0J2<$N$h$&$J(B
code $B$rMQ0U$7$F$_$^$7$?!#(B

% cat > evil.pl
#!/usr/local/bin/perl
# example of exploitable script

use CGI;

$q = new CGI;
$action = "test.pl?\">some%20text<!--%20";

print $q->header;
print $q->start_html('CGI.pm XSS');
print $q->start_form(-action=>$action);
print $q->end_form();
print $q->end_html;

% ./evil.pl var=value
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<HTML><HEAD><TITLE>CGI.pm XSS</TITLE>
</HEAD><BODY><FORM METHOD="POST" ACTION="test.pl?">some%20text<!--%20" ENCTYPE="application/x-www-form-urlencoded">
</FORM></BODY></HTML>

$B$N$h$&$J%3!<%I$K$J$k$G$7$g$&!#(B


perl5.005_03 $B$N>l9g$O!"(Baction $B$N@_Dj$r%W%m%0%i%^$,MQ0U$7$J$$$H(B
$B$$$1$J$$$N$G!"%W%m%0%i%^$N=q$-J}$dCm0U<!Bh$H$$$&$3$H$K$J$j$^$9!#(B

"$B?F@Z$J(B"$BBP1~$r$9$k$H$9$l$P!"(Bstart_form $BFb$G$A$c$s$H(B %XX $B$K(B
$B%(%9%1!<%W$7$F$d$k!"$H$$$&BP=h$G$7$g$&!#(B

$B$?$@$7!"(B

% cat evil2.pl
#!/usr/local/bin/perl
# example of exploitable script
#

use CGI;

$q = new CGI;
$action = "test.pl?\">some%20text<!--%20";
$action = $q->escapeHTML($action);
print $q->header;
print $q->start_html('CGI.pm XSS');
print $q->start_form(-action=>$action);
print $q->end_form();
print $q->end_html;

% ./evil2.pl var=value
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<HTML><HEAD><TITLE>CGI.pm XSS</TITLE>
</HEAD><BODY><FORM METHOD="POST" ACTION="test.pl?&quot;&gt;some%20text&lt;!--%20" ENCTYPE="application/x-www-form-urlencoded">
</FORM></BODY></HTML>

$B$N$h$&$K$9$k$H$o$+$k$h$&$K!"(BPR $B$K(B follow up $B$7$F$$$?$@$$$?!"(B
escapeHTML() $B$G$NBP1~$O4|BT$7$F$$$kBP1~$G$O$J$$$H;W$$$^$9!#(B

$B$*$=$i$/!"(BescapeHTML() $B$G$O$J$/!"(Bescape() $B$NJ}$r;H$&$Y$-$@$H(B
$B;W$$$^$9$,!"$$$+$,$G$7$g$&$+!)(B

$B$^$?!"(Bfollow up $B$7$F$$$?$@$$$?=$@5$O!"0J2<$N$h$&$K(B
$B$7$?J}$,$h$$$+$H;W$$$^$9$,!"$$$+$,$G$7$g$&$+!)(B

--- CGI.pm.orig Wed Sep 17 09:07:05 2003
+++ CGI.pm      Thu Oct  2 00:46:52 2003
@@ -1414,7 +1414,7 @@
     $method = $method || 'POST';
     $enctype = $enctype || &URL_ENCODED;
-    $action = $action ? qq/ACTION="$action"/ : $method eq 'GET' ?
-	'ACTION="'.$self->script_name.'"' : '';
+    $action = $action ? 'ACTION="'.$self->escape($self->script_name).'"' : $method eq 'GET' ?
+	'ACTION="'.$self->escape($self->script_name).'"' : '';
     my($other) = @other ? " @other" : '';
     $self->{'.parametersToAdd'}={};
     return qq/<FORM METHOD="$method" $action ENCTYPE="$enctype"$other>\n/;

Regards,
--- shige
Shigeyuki Fukushima <shige@{FreeBSD,jp.FreeBSD,NetBSD}.org>
