Re: Online use of Gnuplot with PHP, Apache and Linux

[Jonathan T. <jt...@ae...>]

Hi,

You wrote
> I planned to use Gnuplot for online plotting, some thing like what is showing
> on the following URL:
>
> http://www.srcf.ucam.org/~sea31/

I'd just like to warn you that gnuplot is almost certainly *not*
secure against malicious inputs.  That is, it is very likely that
malicious commands could crash or buffer-overflow gnuplot.  You sould
look very carefully at the security risks of allowing untrusted people
to provide gnuplot commands -- they might well be able to take over
control of the gnuplot process and use it for malicious purposes.

ciao,

-- 
-- Jonathan Thornburg <jt...@ae...>
    Max-Planck-Institut fuer Gravitationsphysik (Albert-Einstein-Institut),
    Golm, Germany, "Old Europe"     http://www.aei.mpg.de/~jthorn/home.html
    "Washing one's hands of the conflict between the powerful and the
     powerless means to side with the powerful, not to be neutral."
                                       -- quote by Freire / poster by Oxfam