Re: CGI insecurities

[admin () SUPERDUPS COM (Bill Gilpatric)]

> What about the defense side of things. If you were to allow only
> alphanumberic and selected punctuation characters. i.e. ! . and ?
> (exclamation, period and question mark) have you removed the possibility
> of creating commands that could be executed?
>
> Mainly I am looking for a rule that would disable any kind of execution
> by striping any unacceptable characters from strings sent to the cgi
> prior to passing these values on. Is this feasible? What character set
> could be considered safe? If this preprocessing step also looked at
> string length, is there any room left for exploitation?
>
> Any binary or platform may be referenced in responses. I'm looking for a
> generalized rule.
http://www.phrack.com/search.phtml?view&article=p55-7

thats a good article about which characters to strip...it's focus is perl,
but it's applicable to any cgi thats going to be calling another program
with insecure arguments

-Bill