Re: Sendpage (Perl CGI) Remote Execution Vulnerability

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



[snip]

> To fix, simply filter out all "dangerous" characters:
> ,';"/`\%$#{}-&<>... I prefer to keep things simple and remove all
> non-alphanumeric characters:
>
> 	$message =~ s/[^\w\s]//g;
>

I find that filtering out dangerous characters can lead to problems, as it is 
allways possible to miss one. A safer version is to only allow 'good' 
characters

$message =~ s/[^A-Za-z0-9]//g;

[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux