perl 编写一个安全的CGI程序

[perl]代码库

#-----------------------------
#!/usr/bin/perl -T
open ( FH, "> $ARGV[0]" ) or die;
#-----------------------------
# Insecure dependency in open while running with -T switch at ...
#-----------------------------
$file = $ARGV[0];
# $file tainted
unless ( $file =~ m#^([\w.-]+)$#) {                  # $1 is untainted
	die "filename '$file' has invalid characters.\n";
}
$file = $1;                                         # $file untainted
#-----------------------------
unless ( -e $filename )
{
# WRONG!
	open ( FH, "> $filename" );
# ...
}
#-----------------------------