> Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first. CGI was standardised

> Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environment variables first. CGI was standardised in 1997 to use environment variables to pass information into the CGI program. I'm sure software existed before that that does the same - procmail, perhaps? No software that's been touched in the past two decades should assume that the environment variable is safe. Especially not a shell, which gets used for all sorts of network-processing-related things.