World: r3wp

what permission shouls scripts have, 755 or 775?

maybe I use 775 and it it not needed it to have it so high?

doesn't need to be able to be read

I mean group or world write

1) should be secure. decode-cgi should put only strings in the data, 
nothing executable. (i use a lot "should" when it comes to security 
and i did not double-check).
But why do you do that? simply 
 mold decode-cgi
should give the same.

correction, that response was for 2)

1) trap errors. Big 

 if not attempt[ your code here][ print [header "You triggered some 
 error" footer]

ad 2) preparation for table output ... simple mold was quick option 
... I just wanted to know ...

thanks for 1), I thought so, but did not thought it could be so easy 
:-)

what about 3)? Graham said that FTP client should allow me to set 
permission, but I can't find any option to do it in FTP Total Commander 
provides ...

3) I would not put rebol in cgi-bin. If it is there, one can call 
the rebol-exe from the outside, without it doing a string. Never 
tried that, but it may think post-data is console-input. rights should 
be 755, only you can modify, but everyone can read it. the server 
may call it as "somebody else", and so it must be readable for that 
"user"

2) decode-cgi builds the data itself AFAIK. does not use load. so 
all data should be strings. i am not sure about words, i guess they 
are bound. when you only fetch the words and turn them immediate 
in a string, that should be ok. the usual way is 
 construct decode-cgi
that result is save, because all words are bound to that context.

3) a good client can do that. so i guess yours has an option somewhere.

well, but as for 3) if I only edit my script, overwrite it, the permission 
(after copying it back to ftp) will be preserved. But if I add script, 
it has insufficient permission once again ...

ok, will look around in Total Commander ...

Volker, people say it should not go in cgi-bin .. I have yet to see 
an exploit for this.

i am curious. what is your url?

If you call it .. so what?  You can't feed it parameters.

Ah, found it! Nice, it is in the first menu "Change attributes" ....

if i post something, that goes to "console". I do not know how rebol 
handles that. Hopefully it is smart enough to do nothing.

Volker: http://www.cod-okna.cz/cgi-bin/rebol

i try that post-thing. hope graham is right.

thinking about it .. you would have to have a script in the cgi-bin 
directory that the remote user could exploit.

when you start rebol without script, it takes commands from console.. 
at least with from a real console..

Hmm.  So, the remote user could start up multiple consoles?

if that works. never really tried.

can user go outside his cgi-bin directory, if he copies there script, 
with -cs option?

but console ends imo, no?

with the -s yes.

What if the remote user calls rebol with a url as a parameter... 
?

uh ...

but how you give it a parameter? do you make it part of url? But 
apache will fail, no?

take my above url as an example

well, rebol will take a url as a command line parameter

I think url are passed in another way. in read-cgi is "system/options/cgi/query-string"

http://www.cod-okna.cz/cgi-bin/rebolhttp://www.compkarori.com/test.r


The requested URL /cgi-bin/rebol http://www.compkarori.com/test.r
was not found on this server.
Apache/2.0.50 (Fedora) Server at www.cod-okna.cz Port 80

the basics should be something like this. but does not work.

probe read/custom http://www.cod-okna.cz/cgi-bin/rebol[
 post {print "content-type: text/plain^/^/oho^/"}
]

well, I still think it's safe :)

another try, Pekr does not find a new file.

probe read/custom http://www.cod-okna.cz/cgi-bin/rebolprobe [

 post {write %exploited.txt "Ooops" print "content-type: text/plain^/^/oho^/"}
]

-> i hope does not find.

no new rebols in ps - aux output yet :-)

No, that should only run, make a file in rebols dir and quit. Hmm, 
in the current dir, where is that?

no files in-there ....

then Graham is right i think. although i would not do it :)

well, but it is good option to simply make nearly whatever provider 
a rebol hoster :-)

I think that it is legitimate aproach though. IIRC, my first article 
I read in some 1996 regarding cgi, was stating something like - put 
your C app into cgi-bin directory. Back then the author was describing 
that cgi is simply common gateway interface, and that your executable 
app should be put in cgi-bin directory. And rebol is C app :-)

Petr: <<I mean - above block in 'join statement is reduced - is it 
secure?>>

That should be okay.  You could just do a construct/with to create 
an object.

If you are intending to create an object, then pre-process the block 
from decode-cgi to ensure that the word "self" is not used as a keyword 
(tip courtesy of Chris RG, if I remember rightly).

Not sure. Maybe he means main app?