perl cgi unzip an uploaded file

I am working on a web server where a user can upload a zip file. After uploading, it should unzip the file. I tried the system command unzip as well as the Archive::Extract module. I still get the error:

Insecure dependency in eval while running with -T switch at /usr/lib/perl5/5.10.0/Module/Load/开发者_如何学GoConditional.pm line 332, <GEN3> line 34

Please help.

I guess you are doing something like

system "unzip $value_from_browser";

so the whole thing is an invitation for shell code injection (filename in browser "bla.zip; rm -fr *")

Use the multiargument syntax, which avoids the shell:

system 'unzip', $value_from_browser;

A safer way might be to use Archive::zip, here is some of my working code, it should give you the gist of how to do it. The Archive::zip module has some information too.

sub unpack_zipfiles
{
my $zipfile = shift;  # Name of uploaded zip file
my $zip = Archive::Zip->new();
my $status = $zip->read($zipfile);
if ($status == AZ_OK )
    {
    my @members = $zip->memberNames();
    my $n = 1;
    foreach my $f (@members)
        {
        my @f2 = split(/\//,$f);
# Part 1 - get a filename, and save the file
        my $zf = getNextFile($f2[$#f2]);
        my $unzipped = qq{$unpack_dir/$zf};
        $zip->extractMemberWithoutPaths($f,$unzipped);
# Part 2 - check if it's new or the same, and adjust the filename if necessary
        $zf = check_or_revert($unpack_dir,$zf,$f2[$#f2]);
        $n++;
        push @msgs,qq{Unzipped file: $zf};
# Add file to list of unpacked file (for diagnostic purposes)
        push @{$data{unpacked}},$unzipped;
# Unzipped files are plonked back in the file queue, because there is a loop that deals with them.
        push @{$data{fileq}},$unzipped;
        }
    }
else
    {
    die "Error: $zipfile is not a valid zip file, Zip status=$status";
    }
}