[asterisk-bugs] [Asterisk 0016810]: Dialplan language does not deal with & character safely

[Asterisk Bug Tracker]

A NOTE has been added to this issue. 
====================================================================== 
https://issues.asterisk.org/view.php?id=16810 
====================================================================== 
Reported By:                Nick_Lewis
Assigned To:                lmadsen
====================================================================== 
Project:                    Asterisk
Issue ID:                   16810
Category:                   Core/PBX
Reproducibility:            always
Severity:                   major
Priority:                   normal
Status:                     closed
Asterisk Version:           SVN 
JIRA:                       SWP-900 
Regression:                 No 
Reviewboard Link:            
SVN Branch (only for SVN checkouts, not tarball releases): N/A 
SVN Revision (number only!):  
Request Review:              
Resolution:                 fixed
Fixed in Version:           
====================================================================== 
Date Submitted:             2010-02-11 08:06 CST
Last Modified:              2010-02-18 10:46 CST
====================================================================== 
Summary:                    Dialplan language does not deal with & character
safely
Description: 
The dialplan language uses the & character to represent arrays. For example
123&456&789 is an array of three elements 123, 456 and 789. However the
dialplan language does not prohibit (or escape) the use of a & character in
an array element. This means that the content of an element can cause the
execution of code when passed to a function (in this case the creation of a
new element) 
======================================================================
Relationships       ID      Summary
----------------------------------------------------------------------
parent of           0016808 Create example documentation for usage ...
====================================================================== 

---------------------------------------------------------------------- 
 (0118231) svnbot (reporter) - 2010-02-18 10:46
 https://issues.asterisk.org/view.php?id=16810#c118231 
---------------------------------------------------------------------- 
Repository: asterisk
Revision: 247505

A   branches/1.6.1/README-SERIOUSLY.bestpractices.txt

------------------------------------------------------------------------
r247505 | lmadsen | 2010-02-18 10:46:21 -0600 (Thu, 18 Feb 2010) | 25
lines

Merged revisions 247503 via svnmerge from 
https://origsvn.digium.com/svn/asterisk/trunk

................
  r247503 | lmadsen | 2010-02-18 11:41:04 -0500 (Thu, 18 Feb 2010) | 18
lines
  
  Merged revisions 247502 via svnmerge from 
  https://origsvn.digium.com/svn/asterisk/branches/1.4
  
  ........
    r247502 | lmadsen | 2010-02-18 11:38:17 -0500 (Thu, 18 Feb 2010) | 10
lines
    
    Add best practices documentation.
    
    (issue https://issues.asterisk.org/view.php?id=16808)
    Reported by: lmadsen
    
    (issue https://issues.asterisk.org/view.php?id=16810)
    Reported by: Nick_Lewis
    Tested by: lmadsen
    
    Review: https://reviewboard.asterisk.org/r/507/
  ........
................

------------------------------------------------------------------------

http://svn.digium.com/view/asterisk?view=rev&revision=247505 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2010-02-18 10:46 svnbot         Checkin                                      
2010-02-18 10:46 svnbot         Note Added: 0118231                          
======================================================================