🚀 go-pugleaf

In article <4mppfq$81d@news.ox.ac.uk>,
Malcolm Beattie <mbeattie@sable.ox.ac.uk> wrote:
>In article <318709AF.2A95@daemon.apana.org.au>,
>Frank C. <chopperb@daemon.apana.org.au> wrote:

>>[...] My own research reveals that most interactive Web pages - 
>>approximately 80% - use Perl scripts to execute them. Thus I require 
>>advice on the following matters:
>>
>>1. What security hazard does Perl actually pose?
>>
>>2. How do I rectify the problem i.e. where can I get a suitable CGI 
>>   script?

>   Thanks to an extension module for Perl which allows compartmentalised
>   execution we can now ensure that user-written CGI programs written in
>   Perl can be executed safely. Only a restricted set of the Perl language
>   is available: uses of unsafe features (even within eval statements) are
>   trapped and the program is not run.

That covers one dimension of security, but some scripts can deliberately 
or otherwise consume enough resources to effectively deny service on the 
server.  Aspects such as process table slots, files opened per process, 
number of concurrent processes, and amount of CPU consumed are some of 
the things that worry me.  Some scripts are used tens of times a day and 
work well, the same scripts may cripple a machine if they are run tens of 
times a second.  Some of these issues can be addressed by setting 
suitable resource limits in the script, others need a more global view of 
the machine and HTTP server state to be tackled.

Just a thought,

Mike

-- 
Mike Stok                         |            The "`Stok' disclaimers" apply.
mike@stok.co.uk                   |    PGP fingerprint FE 56 4D 7D 42 1A 4A 9C
http://www.stok.co.uk/~mike/      |                    65 F3 3F 1D 27 22 B7 41
stok@pencom.com                   |       Pencom Systems Administration (work)