>Imagine an attacker is able to inject small files onto the system via a channel that would not let them transmit arbitrary binary data, and that the system is

>Imagine an attacker is able to inject small files onto the system via a channel that would not let them transmit arbitrary binary data, and that the system is otherwise sufficiently firewalled to prevent them from just downloading their own tools without first further compromising the system. I'd just send the binaries base64 encoded. Decoding is trivial, with any number of tools commonly installed in the system. Limiting access to compilers, alone, is 100% useless. You either go a lot farther down that road, or there is no point in starting.