Discuss Version 0.60 DevTrack

Editing version 10 of page Discuss_Version_0.60_DevTrack (the most recent revision is 18)

Note: This page is defined as a special page, and as such its final state may be different from what you see here.

Taint mode (-T) is turned on, however not all shell expansions are untainted. This will generate errors in some installations (apparently not in my dev environment though... weird).

Here are the lines that include shell expansion:

{{{
654:    $line =~ s#\`{1}(.*?)\`{1}#<tt>$1</tt>#g;
741:    '`<tt>teletype</tt>`</dd>'.
1400:    $diff = `diff $TempDir/old $TempDir/new`;
1516:  my $diff = `diff $TempDir/old $TempDir/new`;
1645:  print $q->p("perl: ".`perl -v`);
1646:  print $q->p("diff: ".`diff --version`);
1647:  print $q->p("grep: ".`grep --version`);
1648:  print $q->p("awk: ".`awk --version`);
2289:  chomp(my @files = `grep -Prl '$Param{'search'}' $PageDir`);
2990:  my $diff = `diff $TempDir/old $TempDir/new`;
3179:  chomp(my @counts = split(/\n/,`grep ^$UserIP $VisitorLog | awk '\$2>$spts'`));
}}}

For sure lines 1400, 1516, 2289, 2990, and 3179 should be examined closely.

-- [[AaronGraves|AaronGraves]] //Thu Jun 23 03:57:33 UTC 2016// (107.167.108.182)
----

Lines 1400, 1516, 2289, and 2990 have been untainted. 3179 (now 3194) remains.

-- [[AaronGraves|AaronGraves]] //Thu Jun 23 04:21:45 UTC 2016// (107.167.108.182)
----

Some untainting methods: [[http://www.perlmonks.org/?node_id=516577]]

-- [[AaronGraves|AaronGraves]] //Thu Jun 23 16:10:23 UTC 2016// (107.167.108.182)
----

In `DoSearch`, line 2394:

{{{
open my($FILES), "grep -Erli '($search|$altsearch)' $PageDir 2>/dev/null |";
}}}

This needs to be untainted too.

-- [[AaronGraves|AaronGraves]] //Thu Jun 23 17:15:55 UTC 2016// (107.167.108.182)
----

In addition to the above, this will have to be corrected in ListAllFiles, ListAllTemplates, and ListDeletedPages.

-- [[AaronGraves|AaronGraves]] //Thu Jun 23 17:33:21 UTC 2016// (107.167.108.182)
----

For untainting, see [[https://github.com/ajgraves/aneuch/issues/32]]

-- [[AaronGraves|AaronGraves]] //Fri Jun 24 04:23:51 UTC 2016// (107.167.108.182)
----

For 3179 I would suggest something like this for line 253:
$UserIP = $q->remote_addr; #$ENV{'REMOTE_ADDR'};
        if ($UserIP =~ /^([0-9.]+)$/) {
                $UserIP=$1;
        } else {
                $UserIP='000.000.000.000'; # Redirect to an error page instead?
        }

-- Russ //Sun Jun 26 19:21:16 UTC 2016// (24.113.55.207)
----

Thanks Russ, actually what I used was:

{{{
my ($UIP) = ($UserIP =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/g);   # nnn.nnn.nnn.nnn
}}}

-- [[AaronGraves|AaronGraves]] //Tue Jun 28 01:33:48 UTC 2016// (107.167.108.182)
----

Untainting should be completed.

-- [[AaronGraves|AaronGraves]] //Tue Jun 28 19:50:40 UTC 2016// (107.167.116.86)
----

I re-downloaded aneuch.pl today and think I found two more:
2869:  unlink $file;     (DoMaintPurgeTemp)
1384:  if(! -d "$PageDir/$archive") { mkdir "$PageDir/$archive"; }      (WritePage)

-- Russ //Mon Jul  4 03:46:58 UTC 2016// (24.113.55.207)
----

This page is a template

This file is locked by 3.21.158.34 (ec2-3-21-158-34.us-east-2.compute.amazonaws.com) since Fri Mar 14 21:57:48 UTC 2025.
Lock should expire by Fri Mar 14 22:02:48 UTC 2025, and it is now Fri Mar 14 22:02:11 UTC 2025.

Upload a file

By contributing to this wiki, you acknowledge that you waive your right to claim copyright of your individual contributions. The text of this site is uncopyrighted and released to the public domain.

Styling: **bold**, //italic//, __underline__, --~~strikethrough~~--, `teletype`
Headers: = Level 1 =, == Level 2 ==, === Level 3 ===, ==== Level 4 ====, ===== Level 5 ===== (ending ='s optional)
Lists: * Unordered List, # Ordered List, ** Level 2 unordered, ### Level 3 ordered (up to 5 levels, NO SPACES IN FRONT)
Links: [[Page]], [[Page|description]], [[http://link]], [[http://link|description]]
Images: {{image.jpg}}, {{right:image.jpg}} (right aligned), [[link|{{image.jpg}}]] (image linked to link), {{image.jpg|alt text}}
Extras: ---- (horizonal rule), ~~~~ (signature)