Re: Confirm my false error suspicions of Gitweb query injection

2012-09-10 Thread Joseph Leong
and you earned bonus points for the details - thank you very much! On Mon, Sep 10, 2012 at 10:37 AM, Junio C Hamano wrote: > Joseph Leong writes: > >> Hi Everyone, >> >> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8). >> >> I was poking around and tried a GET Request (REQ) with some SQL >> s

Re: Confirm my false error suspicions of Gitweb query injection

2012-09-10 Thread Junio C Hamano
Joseph Leong writes: > Hi Everyone, > > I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8). > > I was poking around and tried a GET Request (REQ) with some SQL > statements as a search query and noticed a 500. Can i just confirm > with anyone here that the error message I'm seeing in the Response

Re: Confirm my false error suspicions of Gitweb query injection

2012-09-10 Thread Matthieu Moy
Joseph Leong writes: > [RESP] > 500 - Internal Server Error > Unmatched ( in regex; marked by <-- HERE in m/( <-- HERE select > 1234,/ at /var/www/git/gitweb.cgi line 4845. Gitweb is feeding your input as a perl regex, which is not really clean but shouldn't really harm either. I could reproduc

Confirm my false error suspicions of Gitweb query injection

2012-09-10 Thread Joseph Leong
Hi Everyone, I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8). I was poking around and tried a GET Request (REQ) with some SQL statements as a search query and noticed a 500. Can i just confirm with anyone here that the error message I'm seeing in the Response (RESP) is basically saying that the