Re: strange things plugins

On Fri, Dec 31, 2004 at 09:23:57PM +0100, Pavel Kankovsky wrote:
> Here some some things I stumbled over during a recent review of
> Nessus plugins.
> 
> CRLF in some scripts. Grep is your friend. :)

Fixed.

> Ugly "staircase effect" in (re)formatted text. Look at
> redhat-RHSA-2002-289.nasl for a subtle example ("fix"
> on the 2nd line of the text).

Will fix.

> The list of evil format strings in http_header_name_format_string.nasl,
> http_header_value_format_string.nasl et al. should probably be put into
> a shared .inc.

Yes.

> rand() is not a safe way to make temporary filenames.

Who cares ? The temporary files are created in a protected directory
that only root can write in.

> Stupid summaries of redhat-RHSA-*.nasl scripts for multi-package
> updates. For instance: redhat-RHSA-2002-121.nasl's summary talks about
> arpwatch even if the "primary" package of the set is tcpdump.

This needs to be fixed.

> Improper "stemming" of package names in redhat-RHSA-*.nasl. E.g.: 
> redhat-RHSA-2003-246.nasl checks "wu-" rather than "wu-ftpd".

This is a minor issue (for the moment at least), but I'll fix it as well.

> A strange inconsistency: smtp/PORT/real_banner vs www/real_banner/PORT.

Will fix.

> pread() arguments with embedded apostrophes or quotation marks in 
> ssh_get_info.nasl look suspicious.

I could not find any occurence where the quotes where used
inappropriately. The arguments to the 'rpm' commands are ok and do
contain quotes on purpose.

Thanks,


				-- Renaud
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel