From: Matthieu Moy <matthieu.moy@grenoble-inp.fr>
Date: Mon, 10 Sep 2012 17:15:27 GMT
Subject: Re: Confirm my false error suspicions of Gitweb query injection
Message-ID: <vpqvcflhk9c.fsf@bauges.imag.fr>
In-Reply-To: <CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com>

Joseph Leong <josephcleong@gmail.com> writes:

> [RESP]
> 500 - Internal Server Error
> Unmatched ( in regex; marked by &lt;-- HERE in m/( &lt;-- HERE select
> 1234,/ at /var/www/git/gitweb.cgi line 4845.

Gitweb is feeding your input as a perl regex, which is not really clean
but shouldn't really harm either.

I could reproduce with an old gitweb version, but newer gitwebs seem to
be more clever about regular expression (there's an explicit tickbox to
search for re, and the error message is clean when what you provide
isn't a valid regexp).

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/