Stan said:
|Mosaic launch a Perl/Tcl/whatever interpreter in response to the
|appropriate MIME type, one is fair game for any malicious or bumbling
|scripter who happens to put some bad code onto the Web. In Perl, for
|example, one could easily write an "rm -R *" script that would then
|execute with the privileges of the Mosaic user.
I think it's easier than that. You could just send over an "rm -R *"
executed by the /bin/sh. One has always had the capability to add a handler
for csh, sh, Perl, Tcl, Python, ILU, etc. as external viewers. The default
mailcap doesn't have interpreter external viewer for the very reason that it
is very dangerous. User's add this at their own peril.
However, I don't think this has anything to do with CCI, or the Pearl
interface to the CCI. I think there is a misunderstanding here of what
the CCI in NCSA Mosaic 2.5beta is. The Pearl interface is for the *client*
side API (Mosaic is the server). Mosaic does not contain an interpreter.
|
Respond to: Client-Side Scripting on the Web & Security 
