Re:No one expects command execution
by yk on Friday July 03, 2015 @01:20PM
(#9826775)
This way around is perfectly obvious. But assume that you are writing a website that prints a man page, for example by piping the output of man $URLPARAMETER to the user. In that case it is only obvious to check if man can execute arbitrary commands if you already know that man is not just a cat for man pages.
[ Parent
| on HN ]
There are no comments on this comment yet.