Question

以下是用于创建用户帐户的CGI脚本的代码。该脚本将检查是否采用了新帐户的用户名，并且如果未采用用户名，则将创建包含关于新用户的信息（即用户名和密码）的文件。以前，有人问过如何为此文件创建的CGI脚本提供某些特权（链接：Running a Python CGI Script with Sudo Privileges on the Apache Server）。对此脚本的潜在安全问题给出了反馈。例如，有人建议如果在表单中输入路径以创建用户名，则可能会出现问题。服务器设置为禁止访问可能出现问题的某些目录。是否存在其他潜在的安全风险以及哪些可能的解决方案？

感谢您的回答！

#!/usr/bin/python
import cgi, os
import cgitb
cgitb.enable()

# Retrieve form fields
form   = cgi.FieldStorage()                     # Get POST data
fname  = form.getfirst("fname")                 # Pull fname field data
passw  = form.getfirst("passw")                 # Pull lname field data

# Begin HTML generation
print "Content-Type: text/html; charset=UTF-8"  # Print headers
print ""

try:
    with open('Users/%s.py' %(fname)):
            print '''
            <!DOCTYPE html>
            <html>
            <head>
            <link media="screen" type="text/css" rel="stylesheet" href="/style.css"></linK>
            <meta charset="UTF-8">
            <META http-equiv="refresh" content="3;URL=/cgi-bin/createAccount/createAccount.html">
            <meta name="keywords" content="chat, chat.ngrok.com">
            <title>Please Wait</title>
            <body bgcolor="black">
            <div id="navbar">
            <ul>
            <li><a href="/">Home</a></li>
            <li><a href="#">About</a></li>
            <li><a href="/">Create Account</a></li>
            <li><a href="/">Login</a></li>
            <li><a href="/">LinkHere</a></li>
            </ul>
            </div>
            <div class="Container">
            <div class="Header"></div>
            <div id="fire">
            <br>
            <h1>Sorry, this username is already taken!</h1>
            </div>
            </body>
            </html>
            '''
except IOError:
    createU = open('Users/%s.py' %(fname),'w')
    createU.write('''#!/usr/bin/python
    print "Content-type: text/html; charset=UTF-8" 
    print ""
    print "<!DOCTYPE html>"
    print "<html>"
    print "<head>"
    print "<link media='screen' type='text/css' rel='stylesheet' src='/style.css'></link>"
    print "</title>Test</title>"
    print "</head>"
    print "<body bgcolor='black'>"
    print "<div id='navbar'>"
    print "<ul>"
    print "<a href='/'>Home</a></li>"
    print "<a href='/'>About</a></li>"
    print "<a href='/'>Create Account</a></li>"
    print "<a href='/'>Login</a></li>"
    print "<a href='/'>LinkHere</a></li>"
    print "</ul>"
    print "</div>"
    print "<div class='Container'>"
    print "<div class='Header'></div>"
    print "</body>"
    print "</html>"''')
    createU.close()
    os.system('chmod +x Users/%s.py' %(fname))

    print '''
    <!DOCTYPE html>
    <html>
    <head>
    <link media="screen" type="text/css" rel="stylesheet" href="/style.css"></linK>
    <meta charset="UTF-8">
    <meta name="keywords" content="chat, chat.ngrok.com">
    <title>Please Wait</title>
    <body bgcolor="black">
    <div id="navbar">
    <ul>
    <li><a href="/">Home</a></li>
    <li><a href="#">About</a></li>
    <li><a href="/">Create Account</a></li>
    <li><a href="/">Login</a></li>
    <li><a href="/">LinkHere</a></li>
    </ul>
    </div>
    <div class="Container">
    <div class="Header"></div>
    <div id="fire">
    <br>
    <h1>Loading... Please Wait!</h1>
    </div>
    <form action="./test.py" name="FNAME" method="post">
    '''
    print '<input type="hidden" name="passw" value="%s" />' %(passw)
    print '''
    </form>
    <SCRIPT TYPE="text/JavaScript">document.forms["FNAME"].submit();</SCRIPT>
    </form>
    </body>
    </html>
    '''

提高创建用户帐户的Python CGI脚本的安全性

0 个答案: