Git development
 help / color / mirror / Atom feed
From: Matthieu Moy <Matthieu.Moy@grenoble-inp.fr>
To: Joseph Leong <josephcleong@gmail.com>
Cc: git@vger.kernel.org
Subject: Re: Confirm my false error suspicions of Gitweb query injection
Date: Mon, 10 Sep 2012 19:15:27 +0200	[thread overview]
Message-ID: <vpqvcflhk9c.fsf@bauges.imag.fr> (raw)
In-Reply-To: <CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com> (Joseph Leong's message of "Mon, 10 Sep 2012 09:45:08 -0700")

Joseph Leong <josephcleong@gmail.com> writes:

> [RESP]
> 500 - Internal Server Error
> Unmatched ( in regex; marked by &lt;-- HERE in m/( &lt;-- HERE select
> 1234,/ at /var/www/git/gitweb.cgi line 4845.

Gitweb is feeding your input as a perl regex, which is not really clean
but shouldn't really harm either.

I could reproduce with an old gitweb version, but newer gitwebs seem to
be more clever about regular expression (there's an explicit tickbox to
search for re, and the error message is clean when what you provide
isn't a valid regexp).

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/

  reply	other threads:[~2012-09-10 17:15 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-09-10 16:45 Confirm my false error suspicions of Gitweb query injection Joseph Leong
2012-09-10 17:15 ` Matthieu Moy [this message]
2012-09-10 17:37 ` Junio C Hamano
2012-09-10 17:41   ` Joseph Leong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=vpqvcflhk9c.fsf@bauges.imag.fr \
    --to=matthieu.moy@grenoble-inp.fr \
    --cc=git@vger.kernel.org \
    --cc=josephcleong@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox