3 ms·
...filtering out... common Unix commands? By the credit card processor? I would ask 'why', but every time my brain goes there it comes up with terrible, terrib
by david-given 10y ago
...filtering out... common Unix commands? By the credit card processor?
I would ask 'why', but every time my brain goes there it comes up with terrible, terrible scenarios that I just don't want to think about.
- masklinn 10y agoDo you mean you're not supposed to have a system(3) call with a command built by concatenating user-provided strings as part of your validation process?
- david-given 10y agoDON'T WANT TO THINK ABOUT.
- chiph 10y agoTheir explanation was that someone could send them a command line and it might could get executed (like a SQL injection), so they disallowed them pretty early in their processing to prevent it from happening. Is this likely? I'm sure someone has tried it at some point. And an excess of caution is something that I sort of want in a card processor.
- dalke 10y agoBut why only the common unix commands? I can't think of a level of caution where filtering 'echo' is appropriate but, filtering a more obscure command, perhaps 'dc', is not. An excess of caution would be to put the process in its own chroot'ed jail, with only the bare minimum of tools for needed functionality. And '/bin/echo' is not one of those tools.
- detaro 10y agoProbably because they use a web application firewall that's full of strange rules to try to protect any random crappy application behind it.