7 ms·
This would have done nothing to prevent shellshock; placing user submitted data placed in ENVVARs is 'working as intended' for CGI, DCHPCP, etc.
by jldugger 12y ago
This would have done nothing to prevent shellshock; placing user submitted data placed in ENVVARs is 'working as intended' for CGI, DCHPCP, etc.
- emmelaich 12y agoYes, with the whitelist (any whitelist) it would not have stopped shellshock. But having a whitelist would at least make them think about what they use which might help prevent other vulnerabilities. I could propose that the whitelist be parsed before handing to any program. But that would be putting a potentially expensive and difficult job in a higher privileged place. I think the rest is worth considering though.