They're called through os.system. Say that you have a website that relies on downloading content from URLs supplied by users. A user can send a "specially constructed" URL ("anything;commandgoeshere") and run any…
My apologies, I'll be more careful, and more factual.
I apologize for criticizing the person and not the project, but again, the fact that he deleted the issues is unreasonable.
I didn't ever say "Oh god this is a fucking goldmine". That was a reply.
After going through the source code, I can tell for sure that it's an insecure C transpiler. - Most things call just out to C. - A lot of examples don't even compile. - Some things use CLI curl or mkdir, this is…
They're called through os.system. Say that you have a website that relies on downloading content from URLs supplied by users. A user can send a "specially constructed" URL ("anything;commandgoeshere") and run any…
My apologies, I'll be more careful, and more factual.
I apologize for criticizing the person and not the project, but again, the fact that he deleted the issues is unreasonable.
I didn't ever say "Oh god this is a fucking goldmine". That was a reply.
After going through the source code, I can tell for sure that it's an insecure C transpiler. - Most things call just out to C. - A lot of examples don't even compile. - Some things use CLI curl or mkdir, this is…