对于我的简单webapp，这足够验证/清理了吗？

Question

首先，我是一个网络开发新手。我正在制作一个简单的mod wsgi webapp，它有两个文本字段来接受用户输入。在

第一个输入nnodes必须是0-30之间的整数。在

第二个输入size必须是0-20之间的整数或浮点值。在

这是到目前为止我在脚本中的验证/清理。看到我在脚本后面如何使用输入重定向，我希望有人能评论我是否容易受到任何重大恶意威胁：

    nnodes = escape(nnodes)
    size = escape(size)

    if nnodes.isdigit() and int(nnodes) in range(31):
        pass
    elif nnodes=='':
        response_body=html % ' '
        status='200 OK'
        response_headers = [('Content-Type', 'text/html'),('Content-Length',str(len(response_body)))] 
        start_response(status, response_headers)
        return [response_body]
    else:
        response_body=html % 'Please enter the number of malignant nodes as a whole number between 0 and 30.'
        status='200 OK'
        response_headers = [('Content-Type', 'text/html'),('Content-Length',str(len(response_body)))] 
        start_response(status, response_headers)
        return [response_body]

###Validate that the tumorsize is a float between 0-25. 
    try:
        size=='' or float(size)
        pass
    except:
        response_body=html % 'Please enter the tumor size as a number between 0 and 25.'
        status='200 OK'
        response_headers = [('Content-Type', 'text/html'),('Content-Length',str(len(response_body)))] 
        start_response(status, response_headers)
        return [response_body]

    if 0<=float(size)<=25:
        pass
    elif size=='':
        response_body=html % ' '
        status='200 OK'
        response_headers = [('Content-Type', 'text/html'),('Content-Length',str(len(response_body)))] 
        start_response(status, response_headers)
        return [response_body]
    else:
        response_body=html % 'Please enter the tumor size as a number between 0 and 25.'
        status='200 OK'
        response_headers = [('Content-Type', 'text/html'),('Content-Length',str(len(response_body)))] 
        start_response(status, response_headers)
        return [response_body]

###After the validation, I use input redirection to pass the input to an R script.  I know this is not optimal but I can't get the Rpy2 module to work on my server.  
###I also know that input redirection can open an app up to shell injection, but that is why I am asking you all if I've done sufficient validation and sanitization.

commandString="/home/usr/bin/R --no-save --quiet --slave --args " + str(nnodes) + " " + str(size) + " </home/usr/webapps/simple/htdocs/webcalc.R"
subprocess.call(commandString,shell=True)

我很感激你们给我的建议。在

Answer 1

这个代码很难闻。你不清楚你是如何执行规则的。你的代码完全缺乏抽象性。在

在执行安全性验证检查时，不应该使用try/catch all块。除非捕捉到特定的异常类型，否则您不知道操作为什么会失败。对于所有用户数据，您应该能够检查类型、执行强制转换、检查值的范围而不引发异常。另外，您应该使用单个方法来显示错误页。在

Complexity is the worst enemy of security.

Bruce Schneier

Answer 2

“永远不要相信用户”就足够了。“程序员信任”是另一句格言。即使您可能认为您的验证和消毒例程是铁板钉钉的，也可能有一个微妙的错误，允许恶意输入通过。安全总比后悔好。在

我从manpage中找到了更多关于R解释器的信息。显然有一个-f参数可以让您指定一个输入文件。所以这整件事可以解决：

# Split out the filename for easier refactoring
r_script = '/home/usr/webapps/simple/htdocs/webcalc.R'
# We can give an iterable to subprocess.call()
command_args = ['/home/usr/bin/R', '-f', r_script, ' no-save', ' quiet', ' slave', ' args', str(nnodes),
    str(size)]
# And since we don't need shell features like '<', shell=True goes away!
subprocess.call(command_args)

请注意，验证和清理输入仍然非常重要。在