But the problem isn’t putting unchecked content into the file, per se. There is nothing you can put into conditions.txt that would break a text-editor or text-viewer.

However, if conditions.txt is shown again at a latter point via a web page, then it should be escaped prior to showing.

Of course, there are other attacks, such as a disk-space DoS (large conditions will fill the disk up). Etc.

As I said, I haven’t been able to get to the site.

Ciao!

But surely the problem is that it’s displaying an untrusted file? Displaying any kind of log file is displaying untrusted content.

FYI: I’d read the code, but the site seems gone or something.

Ciao!

Because the rules are fetched from the text file and displayed to the user, it is possible to inject malicious HTML (due to CSRF vulnerability) that will then be executed everytime the admin opens that page.

If conditions.txt was conditions.php, it would even be possible to execute malicious queries on the web server.

Doc, if you still don’t follow drop me an email via the BlogSecurity contact form and I’ll explain it further.

Ciao!