I use DBIC with catalyst and even in cases I don't use DBIC I always use placeholders. However I still don't think thats a strong solution or at least it doesnt help me sleep better. I have still seen cases when I have used placeholders and the input variable still ended up escaping something and the query would break or data would be inserted partially. I cant remember for sure but I think it was with a value of 'C:\' with the single quotes like it is there. But not sure if that was the case or not I just remember I had to use the quotesql method before I could pass that variable to interopelate into the execute command.
Also there is params that are not just in the form but also in the URL that can get passed to catalyst. Ideally I would think to be safe and consistant it might be a best practice to write a wrapper around the various validation and checks that can be done and include that in your catalyst app so you can call the wrapper methods to do the checks for you. I just see so many exploits on a daily basis for web apps that I am on the paranoid side and don't usually trust basic checks like variable place holders in dbi or dbic. But its possible those worries are totally unfounded. Thanks, ------------------------------------------ Ali Mesdaq (CISSP, GIAC-GREM) Security Researcher II Websense Security Labs http://www.WebsenseSecurityLabs.com ------------------------------------------ -----Original Message----- From: John Napiorkowski [mailto:[EMAIL PROTECTED] Sent: Thursday, December 13, 2007 1:41 PM To: The elegant MVC web framework Subject: Re: [Catalyst] Input/Parameter Checks --- "Mesdaq, Ali" <[EMAIL PROTECTED]> wrote: > Anyone have some suggestions or references to good modules or best > practices in this regards? This is mainly in regards to using these > inputs in sql queries or other areas where common attacks against web > applications happen. I wonder in the catalyst world what best > practices are. Would it be a catalyst plugin that would best fit that > role or a module that gets used in the controller possibly maybe just > some code in the model? It just feels like its one of those things > that has been solved by someone else way better than I would have done > it and I am just not aware of it. Kinda like when I wrote my own > logging module because at the time I didn't find a good one then I > stumble accross log4perl and realize how badly I wasted my time! > > Thanks, > ------------------------------------------ > Ali Mesdaq (CISSP, GIAC-GREM) > Security Researcher II > Websense Security Labs > http://www.WebsenseSecurityLabs.com > ------------------------------------------ Hi, You have a couple of questions here. First of all, for hardening your SQL, I recommend you use an ORM, like DBIx:Class or Rose::DB to act as a layer between your front end code (collecting form params, for instance, typically in your controller) and the actual database. DBIC (shorthand for DBIx::Class) automatically uses bind parameters, which helps a lot with the SQL inject style attacks. For parameter checking, there's a bunch of stuff floating around. Please do a quick search of the recent archives, you'll find someone asking a similar question with a lot of discussion following. My personal choice for form validation is the system based on HTML::FormFu, which integrates nicely with Catalyst. There is a reasonably active mailing list as well and tons of documentation and examples. But your results may be better served by other things, my opinion is far from canonical. --john ________________________________________________________________________ ____________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ _______________________________________________ List: Catalyst@lists.scsys.co.uk Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst Searchable archive: http://www.mail-archive.com/[EMAIL PROTECTED]/ Dev site: http://dev.catalyst.perl.org/ TO REPORT THIS AS SPAM, PLEASE CLICK THE FOLLOWING LINK: https://www.mailcontrol.com/sr/wQw0zmjPoHdJTZGyOCrrhg== s8WLBdegZqu0wt9pgnuPw6wl0cfc3FOTSj3Rktko5qRAFVm6k1y9KKPTtdPjmqEzO49riMeS bp!3SjWuzjoT7Sh!wb9c90w7QShf6Bw+PxJ0CBxcCvEfU7rz1b6D4F7WWWk5rG+Kjt!B4Nhy !SIC4hksddxQMr9C3VSBKtqujQEyPilqFlGO8fw Protected by Websense Messaging Security ? www.websense.com _______________________________________________ List: Catalyst@lists.scsys.co.uk Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst Searchable archive: http://www.mail-archive.com/[EMAIL PROTECTED]/ Dev site: http://dev.catalyst.perl.org/