3 ms·

It's the requirement for the JSON parser, not for apache. It's like saying apache should quote SQL strings automatically so that SQL injections can't happen. Th

by iopq 12y ago

It's the requirement for the JSON parser, not for apache. It's like saying apache should quote SQL strings automatically so that SQL injections can't happen. This is not apache's job!

sp332 12y ago
It's the job of the CGI program, which is the same code that would have responsibility for sanitizing environment variables before calling bash.
- masklinn 12y ago
  There's nothing for the CGI caller to sanitise, how could and why should it know how arbitrary programs are going to arbitrarily misinterpret what it forwards? The CGI script could be Python eval()'ing it or Ruby interpreting it as a local file to display or delete, and it's no business of the CGI caller that they do. All the CGI caller can and should do is forward correct data as defined by RFC 3875, the rest is not its job. > sanitizing environment variables before calling bash. The CGI caller may not even be calling bash, then what? Should it remove anything which looks like valid PHP code because it's calling a PHP CGI? Oh but now the PHP CGI uses system() which creates a subshell which is still holed, and we end back with: if it becomes the CGI caller's job to cleanup data which could be misinterpreted by application code, the only thing it can do is stop working entirely. Now if you want a mod_bash_is_retarded prefilter feel free to implement one, but it most definitely is not mod_cgi's job to fix that crap, mod_cgi's job is to correctly implement RFC 3875, and the number of times bash is mentioned in RFC 3875 is 0.
  - vidarh 12y ago
    I think you're in violent agreement with the comment you responded to in this case (especially judging with what he's written elsewhere on this thread). He's saying if Apache passes a request to mod_cgi, which spawns "someapp", it is not Apache, but "someapp" that should sanitize the environment before it calls bash. (and of course if the developer/admin has chosen to write their script to be run by bash, that's their mistake)

by iopq 12y ago

It's the requirement for the JSON parser, not for apache. It's like saying apache should quote SQL strings automatically so that SQL injections can't happen. This is not apache's job!

sp332 12y ago

It's the job of the CGI program, which is the same code that would have responsibility for sanitizing environment variables before calling bash.

masklinn 12y ago
There's nothing for the CGI caller to sanitise, how could and why should it know how arbitrary programs are going to arbitrarily misinterpret what it forwards? The CGI script could be Python eval()'ing it or Ruby interpreting it as a local file to display or delete, and it's no business of the CGI caller that they do. All the CGI caller can and should do is forward correct data as defined by RFC 3875, the rest is not its job. > sanitizing environment variables before calling bash. The CGI caller may not even be calling bash, then what? Should it remove anything which looks like valid PHP code because it's calling a PHP CGI? Oh but now the PHP CGI uses system() which creates a subshell which is still holed, and we end back with: if it becomes the CGI caller's job to cleanup data which could be misinterpreted by application code, the only thing it can do is stop working entirely. Now if you want a mod_bash_is_retarded prefilter feel free to implement one, but it most definitely is not mod_cgi's job to fix that crap, mod_cgi's job is to correctly implement RFC 3875, and the number of times bash is mentioned in RFC 3875 is 0.
- vidarh 12y ago
  I think you're in violent agreement with the comment you responded to in this case (especially judging with what he's written elsewhere on this thread). He's saying if Apache passes a request to mod_cgi, which spawns "someapp", it is not Apache, but "someapp" that should sanitize the environment before it calls bash. (and of course if the developer/admin has chosen to write their script to be run by bash, that's their mistake)