On: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

[danielweber]

You are describing blacklisting known bad values.

() {

()+{

Would those make it through? I don't know, neither does the person writing the WAF.