RE: Testing the quickness of signature writers

["Dave Korn" <dave.korn () artimi com>]

On 02 May 2006 19:51, Brian Caswell wrote:

> On May 2, 2006, at 2:20 PM, M. Shirk wrote:
> > > > > pcre:"/[\? \x3b\x26]module=[a-zA-Z0-9]*[^\x3b\x26]/U";
> > >
> > >   A forward slash, followed by any one char from the set ('?', ';', '&')
> > > followed by the literal text "module=" followed by any number (zero or
> > > more) alphanumerics followed by any char that is neither ';' nor '&'. All
> > > matched against the decoded URI buffer.
> >
> > That space after the \? will be evaluated in the character set and
> > the forward slash acts as the bracket for the pcre expression.
>
> In the rule I originally sent, there was no space in the character
> set.  Probably added accidentally when dave copied it in his response.

  Ah, yes, I didn't unwrap the lines correctly; mea culpa.

  BTW I haven't read the original advisory, so I dunno: doesn't this only
check the first cgi param after the end of the path?  Wouldn't it work if you
replaced

http://server/path/?module=EVIL*GOES*HERE&otherparams=stuff&yetmore=more

with

http://server/path/?foo=bar&module=EVIL*GOES*HERE&otherparams=stuff&yetmore=mo
re

or some other re-ordering?

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....