Trouble with -T switch

[Marcus Willemsen]

Hi everybody,

I'm having trouble with setting the path to my sendmail program when using the -T switch. It's a simple script that creates a from, asks for an email adresse and sends an answer after the form was submitted. I keep getting the following error message although I've set the $ENV{'PATH'} in the script. Can anyone help?

Error message:
Insecure directory in $ENV{PATH} while running with -T switch at /usr/local/httpd/cgi-bin/subscribe.pl line 45.

Here is a part of the code
________snippet______

#!/usr/bin/perl -wT
#Pull in modules, create form etc.


sub send_mail {
my $a = shift;
$a = check($a); #sub that check's the email adress
print ("Thank your for ordering our Newsletter.");
$ENV{'PATH'} = "|/usr/sbin/sendmail -oi -t -odq";
open(SENDMAIL, "$ENV{'PATH'}") or die "Can't fork for sendmail: $!\n"; print SENDMAIL <<"FILE";
From: JUVE Newsline <juve-newsline\@juve.de>
To: <$a>
..
..etc

}
_____Snippet______

Thanks Marcus



Marcus Willemsen
Online Redaktion
Juve Verlag GmbH
Sachsenring. 6
50677 Köln
++49 (0)221 91 38 80 16
[url]www.juve.de[/url]


Geschäftsführer: Dr. Astrid Gerber, Dr. Aled W. Griffiths
Sitz der Gesellschaft: Köln
Amtsgericht Köln HRB 29593, Gerichtsstand: Köln
Bankverbindung: Stadtsparkasse Köln, BLZ 37050198, Kto-Nr. 4772281

[Wiggins D Anconia]

> Hi everybody,

>
> I'm having trouble with setting the path to my sendmail program when

using the -T switch. It's a simple script that creates a from, asks for
an email adresse and sends an answer after the form was submitted. I
keep getting the following error message although I've set the
$ENV{'PATH'} in the script. Can anyone help?

>
> Error message:
> Insecure directory in $ENV{PATH} while running with -T switch at

/usr/local/httpd/cgi-bin/subscribe.pl line 45.

>
> Here is a part of the code
> ________snippet______
>
> #!/usr/bin/perl -wT
> #Pull in modules, create form etc.
>
>
> sub send_mail {
> my $a = shift;
> $a = check($a); #sub that check's the email adress
> print ("Thank your for ordering our Newsletter.");
> $ENV{'PATH'} = "|/usr/sbin/sendmail -oi -t -odq";
> open(SENDMAIL, "$ENV{'PATH'}") or die "Can't fork for sendmail:

$!\n"; print SENDMAIL <<"FILE";

> From: JUVE Newsline <juve-newsline\@juve.de>
> To: <$a>
> .
> .etc
>
> }
> _____Snippet______

You haven't shown us where you are untainting $ENV{'PATH'}... I assume
you have read perldoc taint ??

How about not shelling out to sendmail in the above manner at all, and
instead use a module to send your messages? There are many available
and unless you are a Sendmail pro you shouldn't bother with it directly.

[url]http://danconia.org[/url]

[Marcus Willemsen]

> > Hi everybody,

> >
> > I'm having trouble with setting the path to my sendmail program when

> using the -T switch. It's a simple script that creates a
> from, asks for an email adresse and sends an answer after the
> form was submitted. I keep getting the following error
> message although I've set the $ENV{'PATH'} in the script. Can
> anyone help?

> >
> > Error message:
> > Insecure directory in $ENV{PATH} while running with -T switch at

> /usr/local/httpd/cgi-bin/subscribe.pl line 45.

> >
> > Here is a part of the code
> > ________snippet______
> >
> > #!/usr/bin/perl -wT
> > #Pull in modules, create form etc.
> >
> >
> > sub send_mail {
> > my $a = shift;
> > $a = check($a); #sub that check's the email adress
> > print ("Thank your for ordering our Newsletter.");
> > $ENV{'PATH'} = "|/usr/sbin/sendmail -oi -t -odq";
> > open(SENDMAIL, "$ENV{'PATH'}") or die "Can't fork for sendmail:

> $!\n"; print SENDMAIL <<"FILE";

> > From: JUVE Newsline <juve-newsline\@juve.de>
> > To: <$a>
> > .
> > .etc
> >
> > }
> > _____Snippet______

>
> You haven't shown us where you are untainting $ENV{'PATH'}...
> I assume you have read perldoc taint ??

I'm not explicitly untainting $ENV{'PATH'}. As far as I understood
Programming Perl setting the path is enough, but apparently it is not. I
thought only data has to be untained?

>
> How about not shelling out to sendmail in the above manner at
> all, and instead use a module to send your messages? There
> are many available and unless you are a Sendmail pro you
> shouldn't bother with it directly.

I would love to use Mail::Mailer or MimeLite but we are having a bit of
trouble with our ISP and it's always a bit of a hassle to get CPAN
Modules installed.

Marcus

[url]http://danconia.org[/url]

[Wiggins D Anconia]

> > > Hi everybody,

> > >
> > > I'm having trouble with setting the path to my sendmail program when

> > using the -T switch. It's a simple script that creates a
> > from, asks for an email adresse and sends an answer after the
> > form was submitted. I keep getting the following error
> > message although I've set the $ENV{'PATH'} in the script. Can
> > anyone help?

> > >
> > > Error message:
> > > Insecure directory in $ENV{PATH} while running with -T switch at

> > /usr/local/httpd/cgi-bin/subscribe.pl line 45.

> > >
> > > Here is a part of the code
> > > ________snippet______
> > >
> > > #!/usr/bin/perl -wT
> > > #Pull in modules, create form etc.
> > >
> > >
> > > sub send_mail {
> > > my $a = shift;
> > > $a = check($a); #sub that check's the email adress
> > > print ("Thank your for ordering our Newsletter.");
> > > $ENV{'PATH'} = "|/usr/sbin/sendmail -oi -t -odq";
> > > open(SENDMAIL, "$ENV{'PATH'}") or die "Can't fork for sendmail:

> > $!\n"; print SENDMAIL <<"FILE";

> > > From: JUVE Newsline <juve-newsline\@juve.de>
> > > To: <$a>
> > > .
> > > .etc
> > >
> > > }
> > > _____Snippet______

> >
> > You haven't shown us where you are untainting $ENV{'PATH'}...
> > I assume you have read perldoc taint ??

> I'm not explicitly untainting $ENV{'PATH'}. As far as I understood
> Programming Perl setting the path is enough, but apparently it is not. I
> thought only data has to be untained?
>

Ah, I see what you are doing now. I am a little surprised that it is
complaining though I don't know the exact methods it uses. Setting
$ENV{'PATH'} as you have done seems very awkward to me, there is no
reason to assign the path (and arguments) of your sendmail call to the
global %ENV hash. Does it work if you assign it to a plain scalar? If
you must have it in %ENV I would suggest choosing a key that is not a
default and commonly used one...

> >
> > How about not shelling out to sendmail in the above manner at
> > all, and instead use a module to send your messages? There
> > are many available and unless you are a Sendmail pro you
> > shouldn't bother with it directly.

>
> I would love to use Mail::Mailer or MimeLite but we are having a bit of
> trouble with our ISP and it's always a bit of a hassle to get CPAN
> Modules installed.
>

Yeh sometimes that is a problem. I assume you know that modules don't
have to be installed into a root owned directory? In cases where you
don't have shell access this won't help much, always something I check
for when deciding amongst ISPs...

[url]http://danconia.org[/url]

[Jan Eden]

Hi Marcus,

Marcus Willemsen wrote:

>>>Hi everybody,
>>>
>>>I'm having trouble with setting the path to my sendmail program
>>>when using the -T switch.

>>>Here is a part of the code
>> > ________snippet______
>> >
>> > #!/usr/bin/perl -wT
>> > #Pull in modules, create form etc.
>> >
>> >
>> > sub send_mail {
>> > my $a = shift;
>> > $a = check($a); #sub that check's the email adress
>> > print ("Thank your for ordering our Newsletter.");
>> > $ENV{'PATH'} = "|/usr/sbin/sendmail -oi -t -odq";
>> > open(SENDMAIL, "$ENV{'PATH'}") or die "Can't fork for sendmail:

Why don't you set $ENV{'PATH'} to something else and open the filehandle for sendmail explicitly?

$ENV{'PATH'} = "";
open (SENDMAIL, "|/usr/sbin/sendmail -oi -t -odq");

It's one more line (for setting $ENV{'PATH'}, but it should stop -T from complaining.

Are you aware of [email]beginners-cgi@perl.org[/email]? I posted my CGI questions to [email]beginners@perl.org[/email] until someone notified me of this list.

- Jan
--
If all else fails read the instructions. - Donald Knuth

[Marcus Willemsen]

Thanks Jan,

It worked.

> $ENV{'PATH'} = "";
> open (SENDMAIL, "|/usr/sbin/sendmail -oi -t -odq");

> Are you aware of [email]beginners-cgi@perl.org[/email]? I posted my CGI
> questions to [email]beginners@perl.org[/email] until someone notified me of
> this list.

Yes, I am. And I don't know why I didn't post my question there. But on
the other hand using taint mode applies none CGI scripts as well, so I
thought this list might be appropriate.

Grettings Marcus

>
> - Jan
> --
> If all else fails read the instructions. - Donald Knuth
>