Checking folder before creating the new folder [PERL].

[patelxxx]

Checking the folder before actually creating the new folder [PERL].

Can someone guide me in what 'Checks' do I need to do before I create a new folder? I know that one of the checks will be to see if the file already exists or not. What other checks could I do?

See coding for Creating new folder

use CGI;
use strict;
use warnings;
 
my $q = new CGI;
print $q->header(), $q->start_html();
my $path = 'path/to/some/folder/';
$path =~ s|\|/|g;
my $dir = $q->param('folder');
#vaildate the value of $dir to make sure the form has not been altered
$path.=$dir;
mkdir($path) or die "Unable to create folder: $!";
mkdir("$path/hai") or die "Unable to create folder: $!";
 

[miller]

Hello Patel,

The quickest and best advice that I can give you is to simply not allow users to specify folders to be created. It's true that it can secured pretty well, but it's generally bad practice to let them manipulate the file system in so direct a way.

Instead, use a database. They can specify any folder name that they want, and you can create the navigation routines yourself.

Nevertheless, if you must do this, then use the file test functions.

perldoc -X

And make sure that they do not include any spaces or double dots in their folder names.

if ($filename =~ /\s|\.\./) {
    print "Invalid filename\n";
}
 

- Miller

[KevinADC]

I agree with Miller. Allowing this much control by the user is something you have to take very seriously. You should be using taint mode and validating and filtering the user input before allowing the user input to be used as a folder name. Allow only a limited class of characters to be used for folder names: a-z A-Z 0-9 _- and a minimum and maximum number of characters. 3 is a good minimum and 20 ro 30 is a good maximum. There might be other concerns too.