Re: shell script cgi

On Sat, Nov 16, 2002 at 01:44:15AM -0800, Nick Jacobsen wrote:
> Have you considered including qoute characters in the HTTP_USER_AGENT field?

That would require your string to be expanded twice, just like all the other examples that don't do anything bad. echo doesn't expand its arguments, and the shell only expands variables once.

It doesn't matter what you set $HTTP_USER_AGENT to. It's quoted. The worst that you can do with that code snippet is to pass a goofy looking value to sed via stdin. If you're looking for something to exploit, look at how the variable $ua is used later on in the script.

-- 
Ed Schmollinger - schmolli@frozencrow.org