Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm putting together some notes for a dev team on how to write secure Perl code - especially taking into account the current OWASP top 10 web application vulnerabilities. For cross-site scripting I've included information on ensuring that all output to the browser is checked and escaped where necessary, but I'm looking for more automated mechanisms that would mean a developer doesn't have to think about every output statement and, potentially, miss one. Perl's 'taint' function sounds like it should be a help because it distrusts all user input, but it doesn't complain on tainted data being output to the browser. Apart from checking all output statements individually (probably by calling a generic sanitizing function) does anyone have any ideas on how Perl can help with this with existing libraries or techniques?

share|improve this question
    
Good question, but I really think it should be on stack overflow or maybe security.se. –  Jan Hudec Sep 2 '13 at 5:43
    
I'm specifically interested in how developers are writing programmatic solutions to this - i.e. what code might look like or consider. I agree it's partly about process, but it's more about hands-on development techniques I believe. –  David Scholefield Sep 2 '13 at 10:00
add comment

1 Answer

You might want to take a look at the article CERT Secure Coding Initiative Tackles Standard for Perl, the slides about Perl::Critic for Security Audits, and Perl::Critic in general.

share|improve this answer
    
would you mind explaining what each of these resources does and what they're good for? "Link-only answers" are not quite welcome at Stack Exchange –  gnat Sep 2 '13 at 7:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.