Question for Vladdy and perhaps the Perl genius jeffMott

[Scriptage]

Hey,
I was reading the excellent tutorial by Vladdy about communicating with a server side file using javascript. Basically a new element is created in the head of a document with the source set to the cgi program; this means that all kinds of functions can be performed server side by using javascript (sort of).
So to the point....It's quite common that people on these forums ask if it is possible to make a guestbook etc using javascript. So I made a perl file that handles basic file i/o and returns the values in javascript. This essentially gives javascript the ability to read and write files from the server.
This is all well and good but...It gives hackers an easy way to get into the server and mess with stuff. So I was wondering is there any way to disallow calls from anywhere but files located on the server??? So pagex.html on my server could call to the perl program but someone on somesite.com/pagex.html couldn't?
I tried changing file permissions but that won't work. I thought about using the referer to check against but http headers can easily be forged.
If we can get this working then it will be benefical to all js users.
Imagine simply uploading a perl file to your cgi bin and being able to create a file simply by doing the following:

var fileName="somefile.txt";
var text = "hello world!";
file_write(fileName, text);

Thanks in advance

[jeffmott]

So pagex.html on my server could call to the perl program but someone on somesite.com/pagex.html couldn't?I don't think you'll be able to accomplish this, because any type of validation information will have to be provided by the client, which can always be manipulated to be whatever they choose it to be. And while the general idea is a good one, people who usually want to write a guestbook in JavaScript is because their server doesn't allow them access to execute CGI scripts. So they wouldn't be able to run the Perl IO either.

[Vladdy]

Sorry for the late responce - I rarely check CGI forums.
Checking referrer should be the first line of defence, but I agree that its not very reliable.
In case of the guestbook application it is important to program the server script so that whatever input it is given it can only be interpreted as a guestbook entry. Then a hacker would not be able to do any more damage than someone using your guestbook page and posting insulting content.
The method I described has no more security holes than any other server side scripting. The only difference is that it generates Javascript output rather than HTML so it can be received by a client and processed without reloading the page.