back

by pentestercrab·4y ago·view on hn ↗
One idea, maybe using file instead of virtual will avoid the bug and not require your added code.

    <!--#include file="issue-0001.html" -->
Also, be careful of any moves to supporting dynamic content as Server Side Includes can (sometimes?) lead to code exec even with IncludesNoExec.
1 comments
How does this avoid the nesting bug? There are actually two bugs currently for my use-case:

1. The existing one where the code intended to detect nested includes fails to detect it

2. No way to know if nesting is happening, what level, or how many (that's the code I've added to mod_include)