hi there ,

i used retina , for scanning a drupal installation and following issues were reported , i found some suggestions to each issue and want to know if :

Issue : Web Application /html/?options[style_dir] Vulnerabilities :: The presence of the URI '/html/?options[style_dir]=../../../../../../../etc/junk'
Solution : filter options[style_dir] to accept valid directory paths only
Question : Does drupal do that ?

Issue:Web Application index.php?s=-badrow Globally Detected
Solution : escaping input data
Question : does drupal do that ?

any ideas ?
thanks

Comments

tim.plunkett’s picture

Version: 7.12 » 7.x-dev
Priority: Major » Normal
Status: Active » Postponed (maintainer needs more info)

When you say "following issues were reported", reported by what?

brainHax’s picture

its a linux vulnerabilities scanner named Retina . A product of http://www.eeye.com

pasqualle’s picture

Category: Bug report » Support request
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Closed (works as designed)

These paths don't do anything in Drupal core, therefore there is nothing to fix or validate.