Re: [jokosher-devel] Jokosher Security Vulnerability

[John Green <john thegreens co uk>]

On Wednesday 27 September 2006 08:57, Stuart Langridge wrote:
>
> Don't allow semicolons; there's not *all* that much you can do with
> one command. However, do you need that "import os" there? It may
> already be in the environment from the file that executes it. This
> isn't a solution, though, just a workaround.
>
Actually it's only the bit after the semi-colon that's the injected code. The 
bit before has to just not fail with "object." in front of it. So bailing out 
if a semi-colon is present should be enough I think. But like all these 
things the danger is in what you haven't thought of yet.
-- 
John Green

john thegreens co uk