Perl Security

Perl is used for an incredibly wide range of tasks, from system administration, airport boarding passes, web sites, and interfacing with virtual worlds. However like many languages, developers are often unaware of the security pitfalls that may exist, or know that “security is important,” but not know what to do about it.

In this tutorial, we will cover:

• Perl’s in-built tainting mechanism, how to use it, and what it does and does not protect you against.

• How to work with files on multitasking, multiuser operating systems. How to avoid symlink attacks, race conditions, and information disclosure.

• How to safely execute system commands. How to avoid the shell and handle shell meta-characters.

• How to safely manipulate Unix privileges in Perl for scripts running setuid/setgid, or with other elevated privileges.

• How to use Safe compartments and other sandboxing techniques to restrict the operations that Perl is permitted to perform, and to audit data passing between compartments in our system.

• How to operate safely with databases. How taint interacts with Perl’s DBI module. How to recognise and avoid SQL injection attacks.

• Unexpected interactions between Perl and C. How to safely clean up filesystem paths. How using some of Perl’s inbuilt functions may have unexpected results.

Attendees will finish this tutorial with an improved knowledge of Perl’s unique security features and pitfalls, and the skills needed to identify these in their own code and that of others.