use Perl

• Response to Plat_forms conclusions? (Score:2)

  by brian_d_foy (44)

  The full Plat_forms report notes that all the of the Perl teams had trouble implementing the web service requirements and that the Perl solutions did not stand up to malformed URL attacks. Any comments on why that is?
  • Re: (Score:1)

    by dami (6728)

    Web service : yes, that is true. The requirement was a complex WSDL interface and none of the Perl teams found any CPAN module powerful enough to do that; and doing it by hand in 30h. was just impossible.

    About attacks: I guess you mean SQL attacks. We used bind parameters, so we don't agree with what the report says. True enough, the application did not do too much checking on the input, but then wrong data was rejected by the database, and you got an unfriendly error message. That's not nice to the user
    • Re: (Score:2)

      by TeeJay (2309)

      URL attacks are not necessarily SQL Injection - could be XSS, abusing url redirection, setting env vars, modifying session/user/etc id's. Lots of things - what do they actually say in the 118 page report?

      --
      
      @JAPH = qw(Hacker Perl Another Just);
      print reverse @JAPH;
      • Re:Response to Plat_forms conclusions? (Score:1)

        by stu42j (6348) on 2007.06.21 9:33 (#55701) Homepage Journal

        They considered it a failure if an error is returned from the database, rather than the application logic, when testing for SQL Injection. Although, they admit that it is probably not an actual security risk. They also tested for XSS attacks by entering simple html. Non of the Perl teams handled it in a way they considered acceptable. As far as I can tell from my skimming of the report, no actually security breaches were found, only what they considered to be potential problems.

        Reply to This

        Parent

        • Re: (Score:1)

          by rolf (7972)

          For Xss that's not true. As a member of one of the teams I know, that we did html filtering on the user input. And the result shows on page 43 , that two of the perl teams are Ok here.
          Also we do not agree what they say about SQL injection. We were using DBix::Class and relied on bind params. We did no actual filtering of the input or length checking (what I agree is a mistake).
          Also trying to insert 8 byte chinese ideograms while internationalisation was no requirement at all is a bit, well, strange to