Re: Online use of Gnuplot with PHP, Apache and Linux

[Jingzhao Ou <ja...@ya...>]

Hi, Jonathan,

Thanks a lot for your warning. I am going to invoke Gunplot indirectly through
another numerical processing program. So, hope that it will be safe enough. :-)


Best regards,
Jingzhao

--- Jonathan Thornburg <jt...@ae...> wrote:

> Hi,
> 
> You wrote
> > I planned to use Gnuplot for online plotting, some thing like what is
> showing
> > on the following URL:
> >
> > http://www.srcf.ucam.org/~sea31/
> 
> I'd just like to warn you that gnuplot is almost certainly *not*
> secure against malicious inputs.  That is, it is very likely that
> malicious commands could crash or buffer-overflow gnuplot.  You sould
> look very carefully at the security risks of allowing untrusted people
> to provide gnuplot commands -- they might well be able to take over
> control of the gnuplot process and use it for malicious purposes.
> 
> ciao,