3 ms·
Their explanation was that someone could send them a command line and it might could get executed (like a SQL injection), so they disallowed them pretty early i
by chiph 10y ago
Their explanation was that someone could send them a command line and it might could get executed (like a SQL injection), so they disallowed them pretty early in their processing to prevent it from happening.
Is this likely? I'm sure someone has tried it at some point. And an excess of caution is something that I sort of want in a card processor.
- dalke 10y agoBut why only the common unix commands? I can't think of a level of caution where filtering 'echo' is appropriate but, filtering a more obscure command, perhaps 'dc', is not. An excess of caution would be to put the process in its own chroot'ed jail, with only the bare minimum of tools for needed functionality. And '/bin/echo' is not one of those tools.