Re: Confirm my false error suspicions of Gitweb query injection

Joseph Leong [off-list ref] writes:

[RESP]
500 - Internal Server Error
Unmatched ( in regex; marked by <-- HERE in m/( <-- HERE select
1234,/ at /var/www/git/gitweb.cgi line 4845.

Gitweb is feeding your input as a perl regex, which is not really clean
but shouldn't really harm either.

I could reproduce with an old gitweb version, but newer gitwebs seem to
be more clever about regular expression (there's an explicit tickbox to
search for re, and the error message is clean when what you provide
isn't a valid regexp).

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/