Insecure dependency in `` while running with -T switch at

[kokul]

Dear Friends,

I want to take multi lines from a text box in the webpage and pass to my script which saves this into a database. I wrote code like this

my $desc = $cgi->param('comment');

But it gives some error messages when i click commit button in the web page.

"Insecure dependency in `` while running with -T switch at"

Plz help

Kokul

[eWish]

Can we see more of your code?

Meanwhile check out Trouble Shooting Perl CGI Scripts talks about taint mode insecure dependencies. Also check out perlsec.

--Kevin

[kokul]

I get a value from the html page using cgi->param function. Then i want to pass this value to access database. But it showing some error...I'll explain the details..

sub my_func {
 
my $desc = cgi->param('comment');
print "Desc is $desc"; //its works fine. 
 

Now i want to pass this value to database.

my $dbh = Bugzilla->dbh;
 

Here it's showing error:
undef error - Insecure dependency in parameter 1 of DBI::db=HASH(0xa8a628c)-

But when i give a string instead of $desc in the query it's working fine.

Why the value of $desc is not working with query??

Thanks in advance
Kokul

[eWish]

What module are you using that has the method Bugzilla? Again, I will need to know (hint: see more code, modules used, etc...) more to help you. At this pace it is going to take a long time.

--Kevin

[kokul]

Hi,

I want to take a description (atleast 50 characters) from the html page using cgi->param and store it into a string variable in perl and pass this string variable to a query. for this i wrote the following code

my $desc = $cgi->param('comment')
 

then the error occured

Software error:
Insecure dependency in exec while running with -T switch at /var/www/html

So i changed the above line to

my $desc = '';
if ($cgi->param('comment') =~ m/(.+)/) {
   $desc = $1;
}
 

But Its taking only the first line from the text box. I want all the lines in the text box.
How to do that?

[eWish]

Try this as a test and see if it will return more than just one line. This will work in taint mode as well without returning any errors.

#!/usr/bin/perl -T
 
use strict;
use warnings;
 
use CGI;
use CGI::Carp qw/fatalsToBrowser/;
 
my $q = CGI->new;
 
print $q->header; 
print $q->start_html(); 
 
# Get the params from the form.
my %params = $q->Vars;
 
# Loop through eash param and print them.
foreach my $key (keys %params) {
    print "$key => $params{$key}\n";
}
 
 
print $q->end_html();
 
1;

If it still just takes the first line can you post a section of your form. It may not be set to multi line input. Just a thought.


--Kevin

[KevinADC]

param('comment') must be a textarea box sending multiline data to the script. He can add the "s" modifier to the regexp to capture all the lines instead of just the first.