3 ms·
Ensure that a robust escaping routine is in place to prevent the user from adding additional characters that can be executed by the OS ( e.g. user appends |
by Estragon 15y ago
Ensure that a robust escaping routine is in place to prevent the user
from adding additional characters that can be executed by the OS (
e.g. user appends | to the malicious data and then executes another OS
command). Remember to use a positive approach when constructing
escaping routinges.
Surprises me that they regard sending client content to the OS at all.
What is wrong with parametrized execution using using functions like
os.spawn*, which place arguments straight into the called function's argv
list?
- zobzu 15y agotheres more than just python you know. you have to take care of this regardless of the engine behind. beside, even parametrized, you have to be careful. I'll remind you of the 2004 Safari handler exploit. Apple fixed the first exploit by using parametrized argument list. Woot. Next day, exploited again because some programs call execve on their argument list, for example ssh -o'ProxyCommand=exploit here' which is 2 arguments (-o and the complete proxycommand line including the exploit line). This is valid for websites as well.
- yread 15y agoI think they are also talking about file/directory names constructed from user input.