oss-sec mailing list archives
Re: Thoughts on Shellshock and beyond
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Wed, 8 Oct 2014 19:30:55 -0700
I think you're taking on a too rigid mindset here.
Well, I just honestly don't understand how adding the prefix to environment variable fits in the mold of the rule you cite ("When an existing construct in a system is widely expected to be used for storing data, avoid overloading it for use of storing code"). It strikes me as the epitome of overloaded, in-band transmission of code alongside with data - pretty close to the menace of HTML + JS, just done in a slightly smarter way. If what Florian has implemented embodies the spirit of the rule we're preaching here, I'm all for it, but not sure if most developers would interpret it this way. A natural interpretation would be, "don't put functions in the environment", which is fine, except that there aren't many other places to put them if you really want to implement exports in the first place. /mz
Current thread:
- Re: liability, (continued)
- Re: liability dmc (Oct 09)
- Re: liability (was: Re: Thoughts on Shellshock and beyond) Źmicier Januszkiewicz (Oct 10)
- Re: Thoughts on Shellshock and beyond Tim (Oct 09)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 09)
- Message not available
- Re: Thoughts on Shellshock and beyond Sven Kieske (Oct 09)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond ArkanoiD (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Michal Zalewski (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 09)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)
- Re: Thoughts on Shellshock and beyond John Haxby (Oct 09)
- Re: Thoughts on Shellshock and beyond Kobrin, Eric (Oct 09)
- Re: Thoughts on Shellshock and beyond Stephane Chazelas (Oct 08)
- Re: Thoughts on Shellshock and beyond David A. Wheeler (Oct 08)
- Re: Thoughts on Shellshock and beyond Tim (Oct 08)