Re: Confirm my false error suspicions of Gitweb query injection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Joseph Leong <josephcleong@xxxxxxxxx> writes:

> [RESP]
> 500 - Internal Server Error
> Unmatched ( in regex; marked by &lt;-- HERE in m/( &lt;-- HERE select
> 1234,/ at /var/www/git/gitweb.cgi line 4845.

Gitweb is feeding your input as a perl regex, which is not really clean
but shouldn't really harm either.

I could reproduce with an old gitweb version, but newer gitwebs seem to
be more clever about regular expression (there's an explicit tickbox to
search for re, and the error message is clean when what you provide
isn't a valid regexp).

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]