3 ms·
That was one of my first thoughts as well. There is way too much code that's being exposed here. This will be a gift that keeps on giving. For people who wan
by bodyfour 12y ago
That was one of my first thoughts as well. There is way too much code that's being exposed here. This will be a gift that keeps on giving.
For people who want to do environment sanitation, do we know what values can trigger this 'feature'? Is it only "()" as the first two characters? First two non-whitespace characters?
- bodyfour 12y agoAnswering my own question, since I got curious enough to look a the source: if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4)) So it has to start with that four character sequence exactly. I hope there are patches to webservers, sshd, etc to cleanse environment variables with that value. Even if bash is fixed, it is too risky to send untrusted strings to its parser.
- nandhp 12y agoSudo already has a feature like this. /* Skip variables with values beginning with () (bash functions) */ if ((cp = strchr(*ep, '=')) != NULL) { if (strncmp(cp, "=() ", 3) == 0) continue; }
- danielweber 12y agoYou are describing blacklisting known bad values. () { ()+{ Would those make it through? I don't know, neither does the person writing the WAF.