6 ms·
"A CGI script written in bash" You're killin' me here. If you expose a shell script directly to the network, you're exposing a shell and deserve to be pwned.
by isivaxa 12y ago
"A CGI script written in bash"
You're killin' me here. If you expose a shell script directly to the network, you're exposing a shell and deserve to be pwned.
- defen 12y agoIf bash is invoked at any point in the response cycle you are pwned; not just if you are directly exposing a shell script. How confident are you that this never happens on any computers anywhere on your network ever?
- mmastrac 12y agoThat's ridiculous. You may as well say that every time you put a python script up, you're exposing the entire Python runtime and deserve to get 'pwned'. The scope of the risk is limited to script that you write, whether bash or Python.
- Nitramp 12y agoTo be fair, with all the various ways how shell scripts (not only in bash) interpolate, evaluate, substitute etc., the typical shell language is much, much harder to keep safe against code injection than say Python (or even PHP). After all, code injection/evaluation is actually what you want in a shell script, half of the time.