Re:Is there any code in Firefox (as of 2020) that comes from...
by macintux on Friday March 27, 2020 @07:45PM
(#22707915)
I have far less fond memories of Netscape Web Server.
We had a clunky CGI script that crawled the filesystem on request, no doubt a security hole waiting to happen, but Netscape made it worse. (It's possible that other web servers did, or even still do, but I really hope not.)
Anything that the script sent to standard error, which could reveal things like filesystem paths and other sensitive data, was not only logged, but also fed back to the web client as part of the response.
Luckily, because stderr wasn't buffered, in our case it was fed to the browser before any headers, causing the web client to throw up a server error instead of displaying the error messages themselves.
Re:Is there any code in Firefox (as of 2020) that comes from...
by tyingq on Saturday March 28, 2020 @08:43AM
(#22710796)
Maybe my memory, but that feels more like your problem than theirs. NSAPI was fairly well documented, to the point where stderr was your problem to fix, and documented that way.
We had a clunky CGI script that crawled the filesystem on request, no doubt a security hole waiting to happen, but Netscape made it worse. (It's possible that other web servers did, or even still do, but I really hope not.)
Anything that the script sent to standard error, which could reveal things like filesystem paths and other sensitive data, was not only logged, but also fed back to the web client as part of the response.
Luckily, because stderr wasn't buffered, in our case it was fed to the browser before any headers, causing the web client to throw up a server error instead of displaying the error messages themselves.