Senior Project WebBased System

1
Senior Project Web-Based System

• Michael Butt
• CIS 4914 Senior Project
• October 8, 2003

2
Project Overview

• Motivation
• Organization of the Senior Project course process
• Convenience of Web-based applications
• Experience with Perl
• Issues/Problems
• Increased security
• Some functions not working
• Add new features statistics, help system
• Solutions
• Validate user input
• Implement Taint mode SSL
• Fix problematic scripts
• Add help system, statistical routines, access log

3
Project Plan

• Week 1 Reviewed literature
• Week 2 Reviewed current code and planned how
  to
• implement security
• Week 3 Modified code to be portable
• Week 4-5 Implement security measures and
  resolve issues in
• current system
• Week 6-8 Add help system and design new
  features
• Week 8-10 Begin implementing and testing new
  features
• Week 11-12 Resolve bugs discovered while testing
  and
• make necessary changes
• Week 13 Finish final report
• Week 14 Final oral presentation

4
Literature Sources

• Guelich, S., Gundavaram, S., Birznieks, G.
  (2000) CGI Programming With Perl. Sebastopol
  OReilly.
• Wall, L., Christiansen, T., Orwant, J. (2000)
  Programming Perl. Sebastopol OReilly
• Dcode.net., A Brief Introduction to Secure
  Scripting. Retrieved October, 7, 2003 from
  http//cgisecurity.com/lib/secure_scripting.pdf
• Dimov, J., Security Issues In Perl Scripts Perl
  Taint Mode. Retrieved October 7, 2003 from
  http//www.developer.com/open/article.php/631331
• Anon., Perlsec. Retrieved October 7, 2003 from
  http//www.perldoc.com/perl5.8.0/pod/perlsec.html
• Anon., PostgreSQL Documentation. Retrieved
  October 7, 2003 from http//developer.postgresql.o
  rg/docs/postgres/index.html

5
Problems Encountered

• No input validation present
• Implemented validation at script
• Activating Taint mode broke scripts
• ALL user input must be untainted with regular
  expressions
• HTML problems and multiple copies of same images
• Fixed HTML problems
• All pages now refer to one copy of images
• Configuration data (database username/password,
  etc.) hard-coded in each script
• Created configuration file