They're called through os.system. Say that you have a website that relies on downloading content from URLs supplied by users. A user can send a "specially constructed" URL ("anything;commandgoeshere") and run any…
I didn't ever say "Oh god this is a fucking goldmine". That was a reply.
Now that the release is out, it's actually worse than we expected: https://news.ycombinator.com/item?id=20251344
After going through the source code, I can tell for sure that it's an insecure C transpiler. - Most things call just out to C. - A lot of examples don't even compile. - Some things use CLI curl or mkdir, this is…
They're called through os.system. Say that you have a website that relies on downloading content from URLs supplied by users. A user can send a "specially constructed" URL ("anything;commandgoeshere") and run any…
I didn't ever say "Oh god this is a fucking goldmine". That was a reply.
Now that the release is out, it's actually worse than we expected: https://news.ycombinator.com/item?id=20251344
After going through the source code, I can tell for sure that it's an insecure C transpiler. - Most things call just out to C. - A lot of examples don't even compile. - Some things use CLI curl or mkdir, this is…