Re: [Po4a-devel] po4a against untrusted content
Hi,
Thanks for the 2 patches (and the documentation). I committed them.
I made a change in the second one. I don't think there is a need for
checking if STDIN is a terminal, so I removed this test, and I added a
test for STDERR.
(the re-wrapped messages are usually sent to STDERR, so this STDERR check
is probably more important than STDOUT).
On Thu, Jan 15, 2009 at 06:12:58PM +0100, intrigeri(a)boum.org wrote:
Side note: as this works around #470250, and fixes a security issue
(exposed by my ikiwiki plugin use case), is it realistic to get
something based on this patch into Lenny? I would happily provide the
same patch against the po4a package currently in Lenny.
If #470250 is really a security issue (DOS, right?), I would prefer
libtext-wrapi18n-perl to be fixed. This would also provide a fix for
non-programmatic usage of the Locale::Po4a library and even usage of
libtext-wrapi18n-perl outside of po4a.
Do you think this should be raised to the security team and release team?
Best Regards,
--
Nekral