Re: fetch extension - use local filename from content-disposition header

Sean Bryant wrote: 
Barney Wolff wrote:

On Thu, Dec 29, 2005 at 07:33:38PM -0500, Martin Cracauer wrote:


I'm a bit rusty, so please point me to style mistakes in the appended
diff.
The following diff implements a "-O" option to fetch(1), which, when
set, will make fetch use a local filename supplied by the server in a
Content-Disposition header.

Have you considered the security implications of this option?



Its just an extra option. I'm sure the details could be summed up in the man page.

I think what Barney means is that if you run fetch(1) as root and the server returns the filename as "/sbin/init" bad things will happen.
The data returned in Content-Disposition should be used with caution.

--
Pawel
_______________________________________________
freebsd-current@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: fetch extension - use local filename from content-disposition header
    ... diff. ... will make fetch use a local filename supplied by the server in a ... Its just an extra option. ...
    (freebsd-current)
  • Re: SFTPing a File From stdin
    ... Well, assuming the server really supports sftp, as suggested by your ... I haven't verified this though - see diff 2 below if you just don't ...
    (comp.security.ssh)
  • Re: yum-presto - fast updates for Fedora 7
    ... binary/rpm diff. ... If it's the client, that really doesn't cut down on ... where the server does it's thing and reports back to the client ... possibly monetarily) than the bandwidth. ...
    (Fedora)
  • MORE on system restarts (unknown cause) S/B X restarts
    ... I have found something else here apparently the X server is going down, indicating a problem with APM or at least a problem with the X server. ... Please also check the log file at "/var/log/Xorg.0.log" for additional information. ... It contains the same info except for the following lines as shown by diff -- ... (log info above follows) ...
    (Ubuntu)
  • httpd : Forbidden
    ... My main problem is accessing my local server website http. ... Here is the diff between original httpd.conf et mine (to make is ... [me@P4 conf]$ diff -b httpd.conf.orig httpd.conf ... < UseCanonicalName Off ...
    (Fedora)