4 ms·
Answering my own question, since I got curious enough to look a the source: if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
by bodyfour 12y ago
Answering my own question, since I got curious enough to look a the source:
if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4))
So it has to start with that four character sequence exactly.
I hope there are patches to webservers, sshd, etc to cleanse environment variables with that value. Even if bash is fixed, it is too risky to send untrusted strings to its parser.
- nandhp 12y agoSudo already has a feature like this. /* Skip variables with values beginning with () (bash functions) */ if ((cp = strchr(*ep, '=')) != NULL) { if (strncmp(cp, "=() ", 3) == 0) continue; }
- danielweber 12y agoYou are describing blacklisting known bad values. () { ()+{ Would those make it through? I don't know, neither does the person writing the WAF.