Re: svn commit: r1705217 - in /httpd/httpd/trunk: CHANGES server/util_script.c

[Yann Ylavic <yl...@gmail.com>]

On Fri, Sep 25, 2015 at 8:29 AM,  <gs...@apache.org> wrote:
> Author: gsmith
> Date: Fri Sep 25 06:29:05 2015
> New Revision: 1705217
>
> URL: http://svn.apache.org/viewvc?rev=1705217&view=rev
> Log:
> core/util_script: relax alphanumeric filter of enviroment variable names
> on Windows to allow '(' and ')' for passing PROGRAMFILES(X86) et.al.
> unadulterated in 64 bit versions of Windows. PR 46751.

Can one define functions in environment variables on Windows (and if
so is the parenthesis in the place)?
I don't think so, but not very aware of Windows things either, thus
prefer to ask wrt CVE-2014-6271...

What about MinGW or any unix-like shell ported on Windows (which could
be used as CGI)?

Regards,
Yann.

Re: svn commit: r1705217 - in /httpd/httpd/trunk: CHANGES server/util_script.c

[Yann Ylavic <yl...@gmail.com>]

On Wed, Mar 9, 2016 at 1:13 PM, Yann Ylavic <yl...@gmail.com> wrote:
> On Fri, Sep 25, 2015 at 8:29 AM,  <gs...@apache.org> wrote:
>> Author: gsmith
>> Date: Fri Sep 25 06:29:05 2015
>> New Revision: 1705217
>>
>> URL: http://svn.apache.org/viewvc?rev=1705217&view=rev
>> Log:
>> core/util_script: relax alphanumeric filter of enviroment variable names
>> on Windows to allow '(' and ')' for passing PROGRAMFILES(X86) et.al.
>> unadulterated in 64 bit versions of Windows. PR 46751.
>
> Can one define functions in environment variables on Windows (and if
> so is the parenthesis in the place)?
> I don't think so, but not very aware of Windows things either, thus
> prefer to ask wrt CVE-2014-6271...
>
> What about MinGW or any unix-like shell ported on Windows (which could
> be used as CGI)?

It seems we didn't do anything about CVE-2014-6271 et.al. anyway (bash
issue), still I find this permissive env names quite dubious...
Btw, SGIs that really care about these vars could use PROGRAMFILES_X86_ already.