From owner-FreeBSD-users-jp@jp.freebsd.org  Sun Jun 27 23:10:52 1999
Received: (from daemon@localhost)
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) id XAA43118;
	Sun, 27 Jun 1999 23:10:52 +0900 (JST)
	(envelope-from owner-FreeBSD-users-jp@jp.FreeBSD.org)
Received: from tortoise.jp.freebsd.org (root@tortoise.jp.FreeBSD.ORG [210.157.158.41])
	by castle.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP id XAA43113
	for <FreeBSD-users-jp@jp.freebsd.org>; Sun, 27 Jun 1999 23:10:51 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Received: from light.imasy.or.jp (root@light.imasy.or.jp [3ffe:505:0:1:2a0:c9ff:fe61:6521])
	by tortoise.jp.freebsd.org (8.9.3+3.2W/8.7.3) with ESMTP/IPv6 id XAA23192
	for <FreeBSD-users-jp@jp.freebsd.org>; Sun, 27 Jun 1999 23:10:46 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Received: from tasogare.imasy.or.jp (mistral@tasogare.imasy.or.jp [202.227.24.5])
	by light.imasy.or.jp (8.9.3+3.2W/3.7W-light) with ESMTP/IPv4 id XAA07399
	for <FreeBSD-users-jp@jp.freebsd.org>; Sun, 27 Jun 1999 23:10:46 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Received: from mistral.wind.prv (isdn53.imasy.or.jp [202.227.24.245])
	by tasogare.imasy.or.jp (8.9.3+3.2W/3.7W-tasogare/smtpfeed 1.01) with ESMTP id XAA08579
	for <FreeBSD-users-jp@jp.freebsd.org>; Sun, 27 Jun 1999 23:10:45 +0900 (JST)
	(envelope-from mistral@imasy.or.jp)
Message-Id: <199906271410.XAA08579@tasogare.imasy.or.jp>
Received: (from yohta@localhost)
	by mistral.wind.prv (8.9.3/3.7Wpl2-990626) id UAA02994;
	Sun, 27 Jun 1999 20:46:26 +0900 (JST)
Date: Sun, 27 Jun 1999 20:46:26 +0900 (JST)
From: mistral@imasy.or.jp (Yoshihiko -OHTA- SARUMARU)
To: FreeBSD-users-jp@jp.freebsd.org
In-Reply-To: Your message of "Sun, 27 Jun 1999 05:26:44 JST".
	<19990627052644R.j5306050@educ.cs.gunma-u.ac.jp>
X-Mailer: mnews [version 1.21] 1997-12/23(Tue)
Reply-To: FreeBSD-users-jp@jp.freebsd.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+990625
X-Sequence: FreeBSD-users-jp 43642
Subject: [FreeBSD-users-jp 43642] Re: Mail/News reader and Netscape -remote
Errors-To: owner-FreeBSD-users-jp@jp.freebsd.org
Sender: owner-FreeBSD-users-jp@jp.freebsd.org
X-Originator: mistral@imasy.or.jp

$B!!1n4]$G$9!#(B
  $B$I$&$b$*Hh$lMM$G$9!#(B

1999-06-27($BF|(B) 05:26:44.$B:"!"(Bj5306050@educ.cs.gunma-u.ac.jp$B$5$s$O=q$-$^$7$?!#(B

>   $BFp<e$J$N$G(Bperl$B%9%/%j%W%H$r;H$C$F$^$9$,!"$I$J$?$+(BC$B$d(Bsh$B$G=q$$$F$/$@$5$$!#(B
>   $B$"$l!"(BURL$BCf$K(B ' $B$,F~$C$F$k$H$^$:$$$N$+$J(B? $B$^$:$$$G$9$h$M!#%;%-%e%j%F%#%[!<%k$K(B
>   $B$J$j$=$&$J5$$b$9$k$7!#(Bexec$B$9$k$H$-(Bsh$B$K2r<a$5$;$J$$J}K!$C$F$I$&$d$k$s$G$7$?$C$1!#(B

CERT* Advisory CA-97.25.CGI_metachar
Original issue date: Nov. 10, 1997
Last revised: November 12, 1997
Topic: Sanitizing User-Supplied Data in CGI Scripts

$B$H$$$&J88%$K$h$k$H!"(B

        #!/usr/cert/bin/perl
        $_ = $user_data = $ENV{'QUERY_STRING'}; # Get the data
        print "$user_data\n";
        $OK_CHARS='-a-zA-Z0-9_.@';      # A restrictive list, which
                                        # should be modified to match
                                        # an appropriate RFC, for example.
        s/[^$OK_CHARS]/_/go;
        $user_data = $_;
        print "$user_data\n";
        exit(0);

Likewise, the same updated example in C:
($B0J2<N,(B)

$B$H$$$&$N$,>R2p$5$l$F$$$^$9!#(BOK_CHARS $B$rE,Ev$KJQ99$7$F$3$N$h$&$K(B
$BJQ49$9$l$P$$$$$H;W$$$^$9!#C1$K%a%?%-%c%i%/%?$r(B \ $B$G%(%9%1!<%W$9(B
$B$k$N$G$b$$$$$+$b$7$l$^$;$s$1$I!"$=$&$$$&J}K!$G$O:n@.<T$,GS=|$9$Y(B
$B$-$H$7$?J8;z0J30$KM-32$JJ8;z$,$"$C$?$H$-$KBP=h$G$-$J$$$N$GNI$/$J(B
$B$$!"$H$3$NJ88%$G$O<gD%$5$l$F$$$^$9!#(B

>   cc -o netscape-remote remote.c -DSTANDALONE -lXmu -lX11 -I/usr/X11R6/include/ -L/usr/X11R6/lib
> $B$G%3%s%Q%$%k$7$F<B9T$9$k$H!"(B
>   netscape-remote: warning: both version 4.6 (0x34004e9) and version
>           1.1 (0x34003b9) are running.  Using version 1.1.
>   netscape-remote: window 0x34003b9 is locked by pid4084@X68000; waiting...
> $B$H$J$C$F$7$^$$!"$^$@F0$+$;$F$$$^$;$s!#(B

  $B$&!<$s!"$J$s$G$7$g$&$M!#(Bversion 1.1 $B$C$F$3$N%W%m%0%i%`<+BN$J46(B
$B$8$G$9$1$l$I!#$&$A$G$OLdBj$J$/F0$-$^$7$?!#(B 
  $B2<@n$5$s$K65$($FD:$$$?(B global $B$N(B gozilla $B$bF0$-$^$7$?!#(B

  $B$J$+$J$+NI$$46$8$GF0$$$F$$$^$9!#$_$J$5$s$I$&$b$"$j$,$H$&$4$6$$(B
$B$^$7$?!#(B


# ktrace -t n netscape $B$N=PNO$rFI$s$G!"(Bwindows / mac $B$N$h$&$K5/(B
# $BF0%m%4$rI=<($7$F!"!V!{!{$rFI$_9~$_Cf!W$_$?$$$KI=<($9$k%W%m%0%i(B
# $B%`!D!D!"$J$s$F$N$b$I$J$?$+:n$C$F$/$l$J$$$+$7$i(B :-)  $B0JA0%m%4$r(B
# $BI=<($7$F(B netscape $B$N%&%#%s%I%&$,=P$?$i=*N;$9$k%W%m%0%i%`$r=q$$(B
# $B$?$s$G$9$1$l$I!"%G%#%9%/$,%/%i%C%7%e$7$F>C$($F$J$/$J$C$F$7$^$$(B
# $B$^$7$?!#(B
--
$B1n4](B($B5l@+(B: $BB@ED(B)$BK'I'(B (Yoshihiko SARUMARU)
E-mail: mistral@imasy.or.jp
URL: http://www.imasy.or.jp/~mistral/
$B!VBN$N(B 8 $B3d$OBUBF$G9=@.$5$l$F$$$k!W!!!!9pGrJ*8l!?C+@n;K;R(B
