Question

我正在开发一个用户可以上传zip文件的Web服务器。上传后，应该解压缩文件。我尝试了unzip系统命令以及Archive::Extract模块。我仍然得到错误：

Insecure dependency in eval while running with -T switch at /usr/lib/perl5/5.10.0/Module/Load/Conditional.pm line 332, <GEN3> line 34

请帮忙。

Answer 1

我猜你正在做类似

的事情

system "unzip $value_from_browser";

所以整个事情是邀请shell代码注入（浏览器中的文件名“bla.zip; rm -fr *”）

使用multiargument语法，避免使用shell：

system 'unzip', $value_from_browser;

Answer 2

更安全的方法可能是使用Archive::zip，这是我的一些工作代码，它应该给你如何做的要点。 Archive::zip模块也有一些信息。

sub unpack_zipfiles
{
my $zipfile = shift;  # Name of uploaded zip file
my $zip = Archive::Zip->new();
my $status = $zip->read($zipfile);
if ($status == AZ_OK )
    {
    my @members = $zip->memberNames();
    my $n = 1;
    foreach my $f (@members)
        {
        my @f2 = split(/\//,$f);
# Part 1 - get a filename, and save the file
        my $zf = getNextFile($f2[$#f2]);
        my $unzipped = qq{$unpack_dir/$zf};
        $zip->extractMemberWithoutPaths($f,$unzipped);
# Part 2 - check if it's new or the same, and adjust the filename if necessary
        $zf = check_or_revert($unpack_dir,$zf,$f2[$#f2]);
        $n++;
        push @msgs,qq{Unzipped file: $zf};
# Add file to list of unpacked file (for diagnostic purposes)
        push @{$data{unpacked}},$unzipped;
# Unzipped files are plonked back in the file queue, because there is a loop that deals with them.
        push @{$data{fileq}},$unzipped;
        }
    }
else
    {
    die "Error: $zipfile is not a valid zip file, Zip status=$status";
    }
}

perl cgi解压缩上传的文件

2 个答案: