4 ms·
Oh, let me tell you about the saga of Mr Curl trying to update his billing information at a company I used to work for...
by intopieces 9y ago
Oh, let me tell you about the saga of Mr Curl trying to update his billing information at a company I used to work for...
- stephenr 9y agoI don't understand. Are you agreeing with me or suggesting a string with the contents "curl" will somehow cause the server to execute the curl command?
- jessaustin 9y agoMaybe this was back in the days of CGI? It's perfectly feasible that the right combination of characters might break out of an ill-advised pipe to get to the shell.
- ams6110 9y agoYep, it might if it was ever passed to eval()
- intopieces 9y agoThis happened. I was working tech support for a company with a very old billing database. Customer was attempting to update his billing information with a new credit card and was immediately getting an error - Forbidden. Turned out it was his last name, Curl, that was causing the issue. The system was throwing an exception because it interpreted the customer's entry as attempting to execute the curl command. We ended up having him put "JR" at the end of his last name to prevent it.