Vulnerability Development mailing list archives

Re: shell script cgi


From: mlh <mlh () zip com au>
Date: Mon, 18 Nov 2002 21:02:07 +1100

c jones writes in part
>
> ua=`echo "$HTTP_USER_AGENT" | sed "s#\;##g"`
>


One thing that is odd about this scrap of code is
why one would bother removing the ';' yet leave
all sorts of other character sequences that are equally
meaningful to the shell, for instance &, &&, |, || etc.
Also ^ for older shells.


Matt



Current thread: