From owner-freebsd-cvsweb@FreeBSD.ORG  Wed Jul 23 15:00:44 2003
Return-Path: <owner-freebsd-cvsweb@FreeBSD.ORG>
Delivered-To: freebsd-cvsweb@hub.freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6853237B430
	for <freebsd-cvsweb@hub.freebsd.org>;
	Wed, 23 Jul 2003 15:00:44 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4426943FB1
	for <freebsd-cvsweb@hub.freebsd.org>;
	Wed, 23 Jul 2003 15:00:33 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.9/8.12.9) with ESMTP id h6NM0XUp098509
	for <freebsd-cvsweb@freefall.freebsd.org>;
	Wed, 23 Jul 2003 15:00:33 -0700 (PDT)
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.12.9/8.12.9/Submit) id h6NM0XMB098508;
	Wed, 23 Jul 2003 15:00:33 -0700 (PDT)
Date: Wed, 23 Jul 2003 15:00:33 -0700 (PDT)
Message-Id: <200307232200.h6NM0XMB098508@freefall.freebsd.org>
To: freebsd-cvsweb@FreeBSD.org
From: Ville =?ISO-8859-1?Q?Skytt=E4?= <scop@FreeBSD.org>
Subject: Re: ports/52386: [patch] devel/cvsweb and perl5.8
X-BeenThere: freebsd-cvsweb@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: Ville =?ISO-8859-1?Q?Skytt=E4?= <scop@FreeBSD.org>
List-Id: CVS Web maintenance mailing list [restricted posting]
	<freebsd-cvsweb.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-cvsweb>,
	<mailto:freebsd-cvsweb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-cvsweb>
List-Post: <mailto:freebsd-cvsweb@freebsd.org>
List-Help: <mailto:freebsd-cvsweb-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-cvsweb>,
	<mailto:freebsd-cvsweb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Jul 2003 22:00:44 -0000

The following reply was made to PR ports/52386; it has been noted by GNATS.

From: Ville =?ISO-8859-1?Q?Skytt=E4?= <scop@FreeBSD.org>
To: freebsd-gnats-submit@FreeBSD.org, chu@gpi.ru
Cc:  
Subject: Re: ports/52386: [patch] devel/cvsweb and perl5.8
Date: 24 Jul 2003 00:57:09 +0300

 I'm aware of the issue, being a RHL 9 / perl 5.8.0 user here... *duck*
 
 But unfortunately IMO this is just the tip of an iceberg.  The problem
 should be addressed in a more general level than case-by-case; The Real
 Fix would be to untaint $ENV{PATH_INFO} and its derivatives as well as
 all incoming query string parameters.  Some parameters (@unsafevars) are
 already being laundered in CVS HEAD, but that's obviously just a start.
 
 Suggestions/contributions about how to launder that stuff without
 breaking existing setups (think eg. non-ASCII + other unusual characters
 in directory names, valid set of characters for tag/branch names, legal
 CVSROOT "symbolic names" etc) are welcome :)
 
 -- 
 \/