On Thu, Feb 13, 2014 at 02:15:31PM +0100, Pino Toscano wrote:
 +    let expr = "/files/etc/hosts/*[label() !=
'#comment']/*[label() != 'ipaddr'][. = '" ^ oldhost ^
"']" in 
Quoting?  If oldhost contains a ' character + some Augeas code, this
might be exploitable.
I thought it might be possible to iterate over the Augeas tree.  I'm
fairly sure I used to have some code that did this, but I can't find
it at the moment.
Rich.
-- 
Richard Jones, Virtualization Group, Red Hat 
http://people.redhat.com/~rjones
Read my programming blog: 
http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)