PERL Beginners - CGI meets Archive::Zip

Author

CGI meets Archive::Zip

Tim Bowden

2007-12-10, 4:01 am

I'm trying to write a small cgi app that takes an uploaded zip file,
extracts the contents and does some operations on the included files.
Following is a cut down version of my attempts to understand how to
manipulate a zip file. It doesn't work (surprise, surprise!) It
creates an empty file with the correct name, but then dies. It also
won't work using #!/usr/bin/perl -wT, but I haven't tried to sort that
yet. Can anyone please point me in the right direction?

HTML form:
<html>
<head>
<title>Zip test form</title>
</head>
<body>
<form action="/cgi-bin/zip_example" method="post"
ENCTYPE="multipart/form-data">
Zip file: <INPUT TYPE="file" NAME="zip_file"/><br/>
<INPUT TYPE="submit" NAME="submit" VALUE="Upload"/>
</form>
</body>
</html>

Perl cgi:
#!/usr/bin/perl -w

use CGI;
use strict;
use Fatal qw /open mkdir chdir /;
use CGI::Carp qw(warningsToBrowser fatalsToBrowser);
use Archive::Zip qw( :ERROR_CODES ) ;

my @results;
my $working_dir = "/usr/local/example";
my $upload = new CGI;
# form INPUT fields expected:
# TYPE="file" NAME="zip_file"

my $upload_hash_ref = $upload->Vars;
my $upload_hash_ref= $upload->Vars;
$upload_hash_ref->{'zip_file'}=~ s/.*[\/\\](.*)/$1/;

my $zip = Archive::Zip->new();
# I don't think this line does what I want!
$zip->read($upload->upload("zip_file"));
open ZIPINSTANCE, "> $working_dir/$upload_hash_ref->{'zip_file'}";
# Save the Zip file to disk
unless ( $zip->writeToFileNamed("ZIPINSTANCE") == AZ_OK ) {
die 'Here I lay, mortally struck';
}
push (@results, "wrote zip file to disk");

print $upload->header;
print $upload->start_html(-title=>"Zip test results");
print "<h2>Results</h2>";
foreach (@results){
print "<p>$_</p>";
}
print $upload->end_html;

Thanks,
Tim Bowden

Gunnar Hjalmarsson

2007-12-10, 4:01 am

Tim Bowden wrote:
> I'm trying to write a small cgi app that takes an uploaded zip file,
> extracts the contents and does some operations on the included files.
> Following is a cut down version of my attempts to understand how to
> manipulate a zip file. It doesn't work (surprise, surprise!) It
> creates an empty file with the correct name, but then dies. It also
> won't work using #!/usr/bin/perl -wT, but I haven't tried to sort that
> yet. Can anyone please point me in the right direction?

It may be easier to do it in two steps:
1. Upload and save the zip file to disk without Archive::Zip
2. Manipulate the file to your liking

As regards the first step, you may want to use the CPAN module
CGI::UploadEasy. It should work fine in tainted mode.

--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl

Tim Bowden

2007-12-10, 7:59 am

On Mon, 2007-12-10 at 10:16 +0100, Gunnar Hjalmarsson wrote:
> Tim Bowden wrote:
>
> It may be easier to do it in two steps:
> 1. Upload and save the zip file to disk without Archive::Zip
> 2. Manipulate the file to your liking

That was my first approach, and it works fine (manipulating the zip file
on disk using 'system "unzip...";' etc), but I was looking to speed
things up by avoiding unnecessary writing to disk. As the zip file is
already in a perl object, I figured it would be more efficient to either
manipulate it in place (CGI object), or create a new object designed for
zip files (Archive::Zip). Is my thinking way off, or is it worth
pursuing?

>
> As regards the first step, you may want to use the CPAN module
> CGI::UploadEasy. It should work fine in tainted mode.

I've gone and re-read what tainting is all about, and I can see I need
to do some reasonable checking of the name of the zip file before I use
it to write to disk. Either I develop my own tests, or I rely on
CGI::UploadEasy if I can't avoid writing the zip files to disk.

>
> --
> Gunnar Hjalmarsson
> Email: http://www.gunnar.cc/cgi-bin/contact.pl
>
Tim Bowden

Gunnar Hjalmarsson

2007-12-10, 7:01 pm

Tim Bowden wrote:
> On Mon, 2007-12-10 at 10:16 +0100, Gunnar Hjalmarsson wrote:
>
> That was my first approach, and it works fine (manipulating the zip file
> on disk using 'system "unzip...";' etc), but I was looking to speed
> things up by avoiding unnecessary writing to disk. As the zip file is
> already in a perl object, I figured it would be more efficient to either
> manipulate it in place (CGI object), or create a new object designed for
> zip files (Archive::Zip). Is my thinking way off, or is it worth
> pursuing?

It should be noted that the uploaded file is saved on disk as a
temporary file. Also, I can't help wondering if efficiency really is an
issue in this case. The main goal ought to be getting the job done. ;-)

Anyway, your thinking makes some sense. Looking at the Archive::Zip
docs, it appears as if you might have more success if you use the
readFromFileHandle() method rather than the read() method.

--
Gunnar Hjalmarsson
Email: http://www.gunnar.cc/cgi-bin/contact.pl

Sponsored Links