3 ms·
The example is not pathalogical. The property that the PEP states is that the expression should not have side effects, which is the case. Having pathological c
by gizmo686 10y ago
The example is not pathalogical. The property that the PEP states is that the expression should not have side effects, which is the case.
Having pathological code in this context only elavates the severity from a pure data leak to partial code execution. Of course partial code execution in an unexpected context often leads to arbitrary code execution.
- geofft 10y agoIn many webapps, there's a very easy way to go from a data leak to arbitrary code execution. For instance, if you have signed cookies that are pickles of data, the cookie signing key lets you execute arbitrary code (because pickle deserialization can execute arbitrary code).
- dom0 10y ago... which is why it's a poor idea to do that in the first place, since it has literally a single layer of protection against remote, unauthorized, arbitrary code execution, that depends on keeping a static key secret. Much better idea to use a stupid, non-ACE serialization there.