Very true, I just put an advisory notice on the extension page. Thanks!
I'll look into changing the extension to allow locking the gnuplot
command to a specific user instead of the root/httpd user, so that one
could limit it to just being able to create new files in the images
directory.
-David Seymore
Micha Wiedenmann wrote:
> David Seymore wrote:
>
>> Hi All,
>> I just wanted to let you know that I wrote an extension to MediaWiki
>> to allow Gnuplot scripts to be embedded into a wiki article, and
>> displayed as a graph. I wanted to thank all of the developers for
>> Gnuplot, and give back something that is very helpful to my projects.
>>
>> http://www.mediawiki.org/wiki/Extension:Gnuplot
>>
>
> I think that there is a huge security risk, since you can execute
> arbitrary commands with gnuplot, consider input like:
>
> <gnuplot>
> `rm -rf /`
> plot "< rm / -rf /"
> IAmBad(x) = sprintf("< rm -rf /")
> plot IamBad(1)
> </gnuplot>
>
>
>
>
|
