www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-07-30 20:03:10 +03:00
Code Activity

Added a warning that these scripts leak information.

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1423166 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Guenter Knauf
2012-12-17 21:44:32 +00:00
parent 81f9d80b1f
commit f1e3cd4568
4 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/cgi-examples/printenv
View File

@ -4,9 +4,12 @@
# appropriate #!/path/to/perl shebang, and on Unix / Linux also # appropriate #!/path/to/perl shebang, and on Unix / Linux also
# set this script executable with chmod 755. # set this script executable with chmod 755.
# #
# Note that it is subject to cross site scripting attacks on MS IE # ***** !!! WARNING !!! *****
# and any other browser which fails to honor RFC2616, so never use # This script echoes the server environment variables and therefore
# it in a live server environment, it is provided only for testing. # leaks information - so NEVER use it in a live server environment!
# It is provided only for testing purpose.
# Also note that it is subject to cross site scripting attacks on
# MS IE and any other browser which fails to honor RFC2616.
## ##
## printenv -- demo CGI program which just prints its environment ## printenv -- demo CGI program which just prints its environment

9
docs/cgi-examples/printenv.vbs
View File

@ -3,9 +3,12 @@
' To permit this cgi, replace ' on the first line above with the ' To permit this cgi, replace ' on the first line above with the
' appropriate shebang, f.e. '!c:/windows/system32/cscript -nologo ' appropriate shebang, f.e. '!c:/windows/system32/cscript -nologo
' '
' Note that it is subject to cross site scripting attacks on MS IE ' ***** !!! WARNING !!! *****
' and any other browser which fails to honor RFC2616, so never use ' This script echoes the server environment variables and therefore
' it in a live server environment, it is provided only for testing. ' leaks information - so NEVER use it in a live server environment!
' It is provided only for testing purpose.
' Also note that it is subject to cross site scripting attacks on
' MS IE and any other browser which fails to honor RFC2616.
'' ''
'' printenv -- demo CGI program which just prints its environment '' printenv -- demo CGI program which just prints its environment

9
docs/cgi-examples/printenv.wsf
View File

@ -3,9 +3,12 @@
' To permit this cgi, replace ' on the first line above with the ' To permit this cgi, replace ' on the first line above with the
' appropriate shebang, f.e. '!c:/windows/system32/cscript -nologo ' appropriate shebang, f.e. '!c:/windows/system32/cscript -nologo
' '
' Note that it is subject to cross site scripting attacks on MS IE ' ***** !!! WARNING !!! *****
' and any other browser which fails to honor RFC2616, so never use ' This script echoes the server environment variables and therefore
' it in a live server environment, it is provided only for testing. ' leaks information - so NEVER use it in a live server environment!
' It is provided only for testing purpose.
' Also note that it is subject to cross site scripting attacks on
' MS IE and any other browser which fails to honor RFC2616.
'' ''
'' printenv -- demo CGI program which just prints its environment '' printenv -- demo CGI program which just prints its environment

9
docs/cgi-examples/test-cgi
View File

@ -4,9 +4,12 @@
# appropriate #!/path/to/sh shebang, and set this script executable # appropriate #!/path/to/sh shebang, and set this script executable
# with chmod 755. # with chmod 755.
# #
# Note that it is subject to cross site scripting attacks on MS IE # ***** !!! WARNING !!! *****
# and any other browser which fails to honor RFC2616, so never use # This script echoes the server environment variables and therefore
# it in a live server environment, it is provided only for testing. # leaks information - so NEVER use it in a live server environment!
# It is provided only for testing purpose.
# Also note that it is subject to cross site scripting attacks on
# MS IE and any other browser which fails to honor RFC2616.
# disable filename globbing # disable filename globbing
set -f set -f