Confirm my false error suspicions of Gitweb query injection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Everyone,

I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).

I was poking around and tried a GET Request (REQ) with some SQL
statements as a search query and noticed a 500. Can i just confirm
with anyone here that the error message I'm seeing in the Response
(RESP) is basically saying that the search parameters are invalid
because of it's funny chars are breaking the regex search and that
it's not anything database related.  Thank you!

[REQ]
GET /git/?s=%28select+1234%2C HTTP/1.0

[RESP]
500 - Internal Server Error
Unmatched ( in regex; marked by <-- HERE in m/( <-- HERE select
1234,/ at /var/www/git/gitweb.cgi line 4845.

[Code at gitweb.cgi line 4845]
next if $searchtext and not $pr->{'path'} =~ /$searchtext/ and not
$pr->{'descr_long'} =~ /$searchtext/;
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]