Actually, we find two issues here: 1) that this huge attack surface existed in the first place. (almost by design) 2) how they "fixed" it. (not questioning th

Actually, we find two issues here: 1) that this huge attack surface existed in the first place. (almost by design) 2) how they "fixed" it. (not questioning their design at all) The whole bugreport reads like an invitation to find more creative combinations of API calls that their filter forwards to the system. From the first comment: > They're planning to fix those two issues and review all the remaining API's for missing parameter filtering, but wanted to know if I agree that their design is sound. I said I suppose they're correct in theory, but this is a lot of attack surface [...]