#!/usr/local/bin/perl

###########################
## How to use 'taint mode'.
## This script searches the local disk
## for files, depending on the user input.
## THIS IS DANGEROUS, because you are issuing
## commands to the operating system based
## on unknown user input.  Taint mode
## helps make this safer.
##

use CGI;

    my $parse = new CGI;

## Sanitize the environment
## This helps to be sure that when you
## later issue commands, they behave as you
## think they should.
    $ENV{PATH} = '';
    $ENV{ENV} = '';

    ## Get the user input
    my $extension = $parse->param('ext');

    ## Sanitize the user input.  This de-taints $extention.
    $extension =~ /^(\w+)$/;
    $extension = $1;

## This statement flushes STDOUT after each print.
## It's important here, because the call to `ls`
## might write to STDERR.  If that appears
## before the Content-type line, it would
## cause a server error.
    select (STDOUT); $|=1;
    print "Content-type: text/plain\n\n";

## Note the use of chdir, just to be sure
## which directory you are in.  And note the
## use of the full path, '/bin/ls', to be
## sure you don't get a hacked version of 'ls'.

    if ($extension) {
	chdir '/homes/home8/adabyron/cgi-bin';
	@output = `/bin/ls *.$extension`;
	print "I searched for extention '$extension' and found:\n\n@output\n";
    }
    else {
	print "Hey, you didn't give me any input!\n";
	print "(Or maybe you are a nasty hacker.)\n";
    }