Skip to content

Commit

Permalink
*) ISINDEX parameters will not be put on commandline anymore to preve…
Browse files Browse the repository at this point in the history
…nt possible security hazards (better safe than sorry). Parmeters will have to be read from QUERY_STRING in ISINDEX case too which does not seem to be uncommon behaviour for web servers: http://vms.pdv-systeme.de/users/martinv/cgi_basics/cgi_basics.html#Datenuebergabe

git-svn-id: https://svn.berlios.de/svnroot/repos/yacy/trunk@5431 6c8d7289-2bf4-0310-a012-ef5d649a1542
  • Loading branch information
low012 committed Jan 2, 2009
1 parent b6bba18 commit bb5c2cd
Showing 1 changed file with 2 additions and 12 deletions.
14 changes: 2 additions & 12 deletions source/de/anomic/http/httpdFileHandler.java
Expand Up @@ -578,19 +578,9 @@ public static void doResponse(final Properties conProp, final httpRequestHeader
String mimeType = "text/html";
int statusCode = 200;

boolean argToCommandline = false;
// see http://hoohoo.ncsa.uiuc.edu/cgi/cl.html)
if (argsString != null && !argsString.contains("=")) {
argToCommandline = true;
}

ProcessBuilder pb;

if (argToCommandline) {
pb = new ProcessBuilder(targetFile.getAbsolutePath(), argsString);
} else {
pb = new ProcessBuilder(targetFile.getAbsolutePath());
}
pb = new ProcessBuilder(targetFile.getAbsolutePath());

// set environment variables
Map<String, String> env = pb.environment();
Expand Down Expand Up @@ -634,7 +624,7 @@ public static void doResponse(final Properties conProp, final httpRequestHeader

OutputStream os = new BufferedOutputStream(p.getOutputStream());

if (!argToCommandline && method.equalsIgnoreCase(httpHeader.METHOD_POST) && body != null) {
if (method.equalsIgnoreCase(httpHeader.METHOD_POST) && body != null) {
byte[] buffer = new byte[1024];
int len = requestHeader.getContentLength();
while (len > 0) {
Expand Down

0 comments on commit bb5c2cd

Please sign in to comment.